5

Many times, when you fill out a registration form and miss a required field, the form reloads with all the fields filled out except for the password which you have to retype.

I'm wondering if I should do the same. I really prefer not to, because as a user I'm very annoyed by the need to retype the password.

Is it a security measure? What does it protect from?

EDIT: Helping the user remember the password is important, but does not answer the question. Most forms have two password fields anyway, and I see no reason to make the user type the password 4 or 6 times instead of 2.

Improve this question
5
  • 1
    It helps you remember what the password is for the site. People tend to go through forms rather quickly and it's the one field that really matters. So they are mostly making sure that it's a field you take notice of to remember. Since you can't see the password if you've forgotten another required field and it was left filled in you may actually forget what it was.
    – Anagio
    Jan 3 '13 at 23:31
  • @Anagio This doesn't make sense to me, as there are already two password fields on the original form. So retyping the password upon error makes you type it not twice, but 4, 6, 8 times or more. Who could possibly so many retypings to make sure he remembers it correctly?
    – Ilya Kogan
    Jan 6 '13 at 0:54
  • Imagine it were one single field for your password and you just so happened to mistype a single character and you try to login. You would get an error swearing up and down you typed it correctly. It's to help prevent accidents like that as well.
    – Anagio
    Jan 6 '13 at 1:05
  • @Anagio Yes, but usually there are two. I'm editing the question to make this clearer.
    – Ilya Kogan
    Jan 6 '13 at 1:09
  • Seeing the answers and the fact that none of them is based on user studies, I guess the answer is "nobody knows". As far as I'm concern, I never clear the password in the forms I develop since it is so annoying to have to re-enter it, and twice every time. You make two mistakes, you have to enter the password six times. I don't see how anybody could argue this is a good thing.
    – laurent
    Apr 20 '15 at 14:22
2

It's a security measure on so many levels!!!

I. Typing it twice is to make sure you entered it correctly!

What if you entered it just once, made a typo and didn't notice? The site might have a ToS preventing multiple accounts for the same person/email! You might never be able to login to that account/website ever again!

II. Passwords should NEVER be stored in cleartext, nor encoded/encrypted but in a 1 way hash! [ref. CWE-257]

  1. Server-wise: The server can't give you 'back' what you typed because by the time you get the error page the password is either not processed or already hashed or it shouldn't be stored in a format that you can get 'back'.
  2. Client-wise: It's also not a good practice to store the password in a retrievable format in any way (js/cookie/etc)

Final considerations: the password should be known only to you! and it should exist in it's 'true' form only in your head!

Improve this answer
5
  • 1
    I'm not a hater - so no down vote from me but : From the perspective of the "Website" i dont really care if you remember your password or not. I will provide avenues of retrieval and they are so cheap to me its inconsequential. So the only reason for ME (the WEBSITE) to give 2 schmoners about your registration data is if the contact information otherwise, is correct. This is a very subjective question and its important to distinguish (within the business unit) which is more important:the memory of a password or the validity of contact information. - Thats this Riddle of Steel.
    – Brandt Solovij
    Jan 4 '13 at 4:09
  • So what's your take @BrandtSolovij ? You'd make a reg form with only one password field and risk being emailed or called by users to recover their password (you'd get those kind of people regardless of your avenues of recovery) OR you'd just prefill the form again on error with password also set while not taking into account the pointless security issues?
    – CSᵠ
    Jan 4 '13 at 4:26
  • no. Im simply suggesting that the beneficial purpose to forcing a user to re-enter their password upon form validation failure is better to be viewed as a "data validation in totality" exercise than a "user convenience" approach. The end result is the same : Force them to re-enter their password. However the "why" is a or what could be called a manipulation of behavior : The bottom line is we (useful websites) want "real" people registering. I would love to chew up email bandwidth for someone that wants to actively participate in "my" website.
    – Brandt Solovij
    Jan 4 '13 at 4:33
  • @BrandtSolovij: got your point, since in your case you would do anything to help a user who forgot/misspelled the pwd you could drop the 2nd password field in the reg form, but still you shouldn't store the password in any way in case the user missed some other required field, and you can achieve this via AJAX anyway
    – CSᵠ
    Jan 5 '13 at 22:39
  • Sorry, but this is not convincing. Firstly, there are already two password fields in the original form, so retyping the password upon error makes you type it not twice, but 4, 6, 8 times or more. Secondly, there's a simple solution to this issue: you don't really need to save the real password on the client-side after the user has submitted it for the first time. Just save it hashed and show "•••••••••••••••" to the user.
    – Ilya Kogan
    Jan 6 '13 at 0:50
0

Simply put, this is for better security. In order to store data on the form that has already been typed, it's going to be stored by a script to a session variable or appended to a referred link. You don't want to store password data this way. The data can often be easily intercepted or spoofed, so it's best practice not to do this.

Is it possible to do this, yes...but you shouldn't. Plus, most browsers (if configured to store form data), will simply remember a regular input field, keeping that data stored across browsing sessions...but they'll ignore password-type input fields by default.

As an added benefit, it also helps the user to remember the password they typed, by having to do it more than just once or twice. As annoying as it may be, until a better method is more widely accepted and accessible, this is typically how it's going to be done.

Improve this answer
3
  • Thank you, but this is not convincing. Firstly, there are already two password fields in the original form, so retyping the password upon error makes you type it not twice, but 4, 6, 8 times or more. Secondly, there's a simple solution to this issue: you don't really need to save the real password on the client-side after the user has submitted it for the first time. Just save it hashed and show "•••••••••••••••" to the user
    – Ilya Kogan
    Sep 6 '17 at 7:05
  • Let me answer this a different way. If I am presented only one password field and type, for the sake of argument, "passwoed," instead of "password," and then I go to login, I can't. I think I've typed it correctly, but didn't.
    – psiclone
    Sep 7 '17 at 13:19
  • This means I have to go through a whole set of other steps to recover or reset my password. Storing the password on the client machine is asking for trouble, especially since the server then has no way to update the encryption scheme for that password. This means if a better encryption scheme comes along, the server cannot do anything with that password. Not all end clients will allow files to be stored/written by script, which is yet another reason that's an unreliable approach.
    – psiclone
    Sep 7 '17 at 13:33
-1

The only real reason I see for clearing the password form on a required field failure - is that it prevents the user from updating "just fixing the one field and submitting the data"

The mindset I have to this is that : If the form is designed well and obviously enough attention was spent in the pre-processing sub action coding ---- then if someone still missed a required field, other data may be incorrect.

Wiping the password field is a way to give the user a forced pause to not just add in the required data but also gives them the opportunity to (hopefully) verify the rest of their information on the form.

Security wise - this doesn't really provide much unless someone hit submit on a public computer and immediately left the computer before the oversight was detected and the user (now absent) is prompted to fill in the offending field.

Little to no security benefit - mostly just a way to hopefully prod the user to verify information before they submit again.

-my take on it.

Improve this answer
1
  • This feels like a UX or Stack question - donut?
    – Brandt Solovij
    Jan 4 '13 at 5:35
-1

It's a trade-off between a security measure and the requirement for data capture - if a user has gone to the trouble of registering their details with you, it is not a good idea to have to make them re-enter each form field. They are as likely to abandon the registration process. It's much easier just to make them simply re-type the password twice, which of course protects them from nothing, but gives an added sense of security to the unwary. Depending on your level of need for registered users, either clear the form or just the password fields. Clearing the whole form provides slightly better security.

Improve this answer
6
  • 3
    "Clearing the whole form provides better security." - in what way?
    – MrWhite
    Jan 3 '13 at 23:35
  • In that a completed form left unattended even momentarily may still contain personal details useful to anyone collecting data. At least if you clear the form, no-one else can see the persons data, should they be foolish enough to leave a public pc carelessly.
    – Ipolit
    Jan 4 '13 at 0:16
  • 1
    @Ian But that's no different to if a user typed something then left the PC without submitting.
    – DisgruntledGoat
    Jan 4 '13 at 1:20
  • Im subscribing to the w3d's comment : Security ?! yo momma! There is literally .001% of form interaction security in this practice.
    – Brandt Solovij
    Jan 4 '13 at 5:34
  • I agree that security is virtually non-existent, but was purely stating in a general sense that in the event that user believed they had submitted the form, to protect their personal data it would be better if the form reloaded empty, rather than with all their details.
    – Ipolit
    Jan 4 '13 at 7:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.