30
2
While I was entering my password in Gmail and other mail accounts, I could see a symbol of an "eye" in the text box.
This is really dangerous because once you click on the eye, your password is revealed.
Is there any way I can disable that eye symbol? I'm getting this in Internet Explorer. Has anyone else encountered it?
Harish Shivaraman
Posted 2012-10-21T10:09:15.340
Reputation: 839
34
The new 'eye' symbol is present in all the password fields in Internet Explorer 10 which comes default with Windows 8 (and is also available for Windows 7). To reveal the password, the user needs to keep the 'eye' symbol pressed.
Disabling it (in Windows 8):
Please note that to do the following, you will need to access the Local Group Policy Editor, which is only available in Windows 8 Pro. You can see if you have Windows 8 Pro by pressing Win+Pause, which opens the System Properties window. If under "Windows Edition" you see Windows 8 Pro, you will be able to access the Group Policy Editor.
To disable the "eye" symbol, follow these steps:
Open the Run dialog (Win+R)
Enter gpedit.msc and press Enter
Local Group Policy editor will open:
Navigate to Computer Configuration → Administrative Templates → Windows Components → Credential User Interface:
Double-click on "Do not display the password reveal button" and select the "Enabled" option:
The behaviour is disabled, you can enable it with the same method.
Source: Enable or Disable Password reveal option in Windows 8
Akshat Mittal
Posted 2012-10-21T10:09:15.340
Reputation: 2 195
5You should note that "hiding" the password doesn't give any safety to anything but the person standing behind you while you type. So unless that person is handling the mouse to click the button no security has been breached at all. And even in all previous Windows versions passwords from "hidden" passwords fields can be trivially retrieved. – orlp – 2012-10-21T13:36:38.700
2@AkshatMittal: yes, but you did not note the misconception in his question: "This is really dangerous because once you click on the eye, your password is revealed.". – orlp – 2012-10-21T13:47:13.150
@nightcracker I did note that, but the simple thing is he asked for 'How to disable it?' – Akshat Mittal – 2012-10-21T13:48:43.793
@nightcracker - I totally agree, getting the contents of a textbox in Windows is (was) very easy. In memory, most of the time, the password is stored in the clear. – Natalie Adams – 2012-10-22T17:58:12.620
strange that I can't find a place to go to Local Group Policy Editor without using a command line ... back to DOS times! – sergiol – 2013-04-25T12:09:34.783
9This happens to be one of my favorite features in Windows 8, and removes the illusion of security provided by 'little dots'. – Tanner Faulkner – 2012-10-21T16:12:15.183
2There is some security provided by the 'little dots' - malicious software taking screen shots or someone standing behind you can otherwise read the password. – markmnl – 2014-01-14T07:03:22.617
@markmnl If you got a password stealing malware product on your computer, I'd assume it uses something more reliable than a simple screenshot (which would need OCR or human intervention and only works when the password is visible), like keylogging or any browser based attack. Even social engineering would be more reliable. – Nzall – 2014-01-14T15:21:34.970
1@NateKerkhofs malware has used this technique in the past so it is not detected by anti-malware that would block key-logging - security is all about preventing all vulnerabilities otherwise there wouldn't be much point - should a prison only have guards at the main gate :) – markmnl – 2014-01-15T01:25:31.380