8
votes
Is a "Show Password" option on login form safe?
Apart from the obvious security issue of someone else being able to physically see what password you are typing - which the user would be aware of anyway - there are a few security "concerns" that ...
- 43k
5
votes
Is a "Show Password" option on login form safe?
If we are ignoring everything else you mention, (i.e. shared computer, firefox saved passwords, etc.) the "show" password feature is, by itself, not a security risk. It is for convenience and the "...
- 151
4
votes
Accepted
Is a "Show Password" option on login form safe?
There is no inherent security issue with unmasking the password field per-sey. In the functional working of a site any method that can access form fields (such as server side posts or javascript) will ...
- 10.2k
2
votes
How do I exclude a WordPress site from search engines and make it accessible only via password?
Why not put a HTTP auth username and password on the site. This is done using .htaccess and .htpasswd files if you want to do it manually and learn something.
Or as with most things WordPress, ...
- 8,511
2
votes
Accepted
Password protect specific files on root of website
I read that the htaccess/AuthName text does not get displayed on the login popup on chrome so I need an alternative.
The "alternative" is to role your own authentication system (which could ...
- 43k
2
votes
Accepted
How to handle password protected page?
Some suggestions
You should use a noindex on the profile pages.
If you are able to, then don't have a link to these pages on your site. You can do this in the backend by removing the link if the ...
- 2,574
1
vote
.htaccess problem with people with identical usernames
I might tackle this problem by not using .htaccess and instead replace it with php code (looks better, allows more granular control and tracking of the different users. Authentication could be done ...
- 8,213
1
vote
Link from a Wordpress page to a password protected non-Wordpress page on a subdirectory
From the information given, this "should" work as intended. Whether the directory is protected by HTTP Authentication in this way should not matter.
I see "This page doesn't seem to exist."
I'm ...
- 43k
1
vote
Accepted
What does mask spring authentication nginx configuration do?
I don't know what it exactly does, but I assume you want to rename the parameters. The parameters have to be POSTed anyway, so there's no way around that, but if you want to rename to something else, ...
- 126
1
vote
How to deal with users passwords on website re-design?
My suggestion is not to do this. I would tell the users that you're making a change/upgrade/switch over to a new system. Tell them they'll be prompted for a new password the next time they login and ...
- 87
1
vote
SIMPLEST way to set up password protection for a static site, with basic admin UI?
Anything you do to handle authentication even if it is a static site will still become somewhat dynamic simply from the need to have a database backend for authentication, which in turn means more ...
- 10.2k
Only top scored, non community-wiki answers of a minimum length are eligible