145117 - ask before submitting form password in cleartext

Status: NEW

(SeaMonkey :: Preferences, enhancement)

Description

[Scott McPeak]

I think Mozilla should include a preference to warn the user before a
form is submitted which contains a type="password" input field (into which
the user has typed some text), if the submission is not encrypted.  The
warning should include the option to cancel the submission.

Comment 1

[Boris 'pi' Piwinger]

Is the setting to warn for form data unencrypted not good enough?

pi

Comment 2

[Scott McPeak]

Sending unencrypted form data (to bugzilla, for example) is so routine
that I always turn off that warning.  It is however much less common to
send form data which includes a type="password"; and at those times I
want encryption, and I'd like a pref so Mozilla will verify for me (b/c
I might forget to glance at the padlock).

Comment 3

[Boris 'pi' Piwinger]

You got a point here.

pi

Comment 4

[Adrian Mettler]

This would be a useful feature to have, since even looking at the padlock does
not always indicate whether or not a password will be sent in cleartext.  On
Bank of America's website, for example, you must enter your username and
password before the padlock is shut, and some JavaScript magic launches an SSL
session which sends the password encrypted.  (Or at least I assume this is what
happens; otherwise the only secure way to login would be to intentionally
misspell your password the first time [the "try again" page displays a padlock],
which seems unlikely).

Comment 5

[Serge Gautherie (:sgautherie)]

(Filter "spam" on 'prefs-nobody-20080612'.)

Comment 6

[Phoenix]

Looks like still valid rfe