834534 - [hotspot] "Show password" option is needed for Wi-Fi hotspot password

Status: RESOLVED FIXED

(Firefox OS Graveyard :: Gaia::Settings, defect)

Description

[leo.bugzilla.gecko]

"Show password" option is needed for Wi-Fi hotspot password becasue of security reason. Anyone can see my phone screen when I turn on wi-Fi hotspot.

Comment 1

[Dietrich Ayala (:dietrich)]

This would be *very* nice to have, but not serious security issue enough to block the entire release for 1.1.

Marking tracking+, would take a patch.

Comment 2

[Mihai Cirlanaru [:mihai][:mcirlanaru]]

Evan, are you working on this bug? If not, I would like to take it (assign it to me if so).

Comment 3

[Evan Tseng [:evanxd]]

Hi Mihai,

OK, you could take it. I'm working on another issue.

Thanks. :)

Comment 4

[Mihai Cirlanaru [:mihai][:mcirlanaru]]

From my understanding, a "show password" checkbox should be available for the following: 
1. "Internet Sharing" main screen, where the password is displayed in plain view with the other hotspot configuration details
2. "HotSpot settings" screen, where a password can be inputted

While for point 2. the UI can be similar to the WiFi login screen, how should the UI for point 1. look like (i.e. where should the "show password" checkbox be placed)? or should the password be shown at all in this case?

Comment 5

[Casey Yee]

For the purposes of Internet sharing it is useful to show the password in plain view.  This is also why the password does not hide on entry and do not offer to show the password on the hotspot settings screens.

All other cases where passwords are entered for credential purposes we should be hiding entry [ie: *******d] and have the option to [ ] show password.

Comment 6

[Mihai Cirlanaru [:mihai][:mcirlanaru]]

Attachment: Pull Request #8984 - Add 'show password' functionality to HotSpot Settings

Based on Casey's comment I only left the 'show password' functionality for the HotSpot Settings (where the user inputs a password).

Comment 7

[Arthur Chen [:arthurcc][inactive after 6/30]]

Mihai, the patch looks good. However, with the patch once users check "show password", it remains checked until they restart settings app. I would suggest observing the url changes and unchecked "show password" when users enters the subpanel.

Comment 8

[Mihai Cirlanaru [:mihai][:mcirlanaru]]

(In reply to Arthur Chen [:arthurcc] from comment #7)
> Mihai, the patch looks good. However, with the patch once users check "show
> password", it remains checked until they restart settings app. I would
> suggest observing the url changes and unchecked "show password" when users
> enters the subpanel.

Thanks for the feedback, Arthur! Updated the patch to reset the password input type and "show password" button state. Also added the r flag in the commit message, so feel free to merge it to master if everything looks good.

Comment 9

[Arthur Chen [:arthurcc][inactive after 6/30]]

Comment on attachment 733230 [details]
Pull Request #8984 - Add 'show password' functionality to HotSpot Settings

r=me. Although I'm not sure about the UX is what the reporter want. Currently the password is hidden in the dialog but displayed in the main panel.

Comment 10

[Arthur Chen [:arthurcc][inactive after 6/30]]

master: https://github.com/mozilla-b2g/gaia/commit/f219c47b0b05ee73e9bf683bae30440863cb301e

Comment 11

[Mihai Cirlanaru [:mihai][:mcirlanaru]]

Comment on attachment 733230 [details]
Pull Request #8984 - Add 'show password' functionality to HotSpot Settings

NOTE: Please see https://wiki.mozilla.org/Release_Management/B2G_Landing to better understand the B2G approval process and landings.

[Approval Request Comment]
Bug caused by (feature/regressing bug #): HotSpot Settings > create password
User impact if declined: Low (password is visible while typing)
Testing completed: Yes
Risk to taking this patch (and alternatives if risky): Low
String or UUID changes made by this patch: No

Comment 12

[Alex Keybl [:akeybl]]

Comment on attachment 733230 [details]
Pull Request #8984 - Add 'show password' functionality to HotSpot Settings

We're past the point of taking new enhancements/strings for non-blocking work. Apologies. This will first ship in v1.2.