242418 - Password Manager password-displaying font has ambiguous characters

Status: VERIFIED FIXED

(Thunderbird :: Security, defect)

Description

[harm]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.7b) Gecko/20040421
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.7b) Gecko/20040421

The passwords in the password manager are displayed in a font where not all
chars can be distiguished.
The capital i 'I' and the small L 'l'  are identical, making it impossible to
actually read the password.

Reproducible: Always
Steps to Reproduce:
1. Click Tools - Password Manager -Manage stored password
2. Click show passwords
3. enter master password

Actual Results:  
The passwords are listed in some sans serif font where the I (capitol i) and l
(small L) are indistinguishable.

Expected Results:  
The passwords are listed in any font where individual characters are
distinguishable. (even I and l)  For example couries would do OK.

Comment 1

[Robert Kaiser]

MASS-CHANGE:
This bug report is registered in the SeaMonkey product, but has been without a comment since the inception of the SeaMonkey project. This means that it was logged against the old Mozilla suite and we cannot determine that it's still valid for the current SeaMonkey suite. Because of this, we are setting it to an UNCONFIRMED state.

If you can confirm that this report still applies to current SeaMonkey 2.x nightly builds, please set it back to the NEW state along with a comment on how you reproduced it on what Build ID, or if it's an enhancement request, why it's still worth implementing and in what way.
If you can confirm that the report doesn't apply to current SeaMonkey 2.x nightly builds, please set it to the appropriate RESOLVED state (WORKSFORME, INVALID, WONTFIX, or similar).
If no action happens within the next few months, we move this bug report to an EXPIRED state.

Query tag for this change: mass-UNCONFIRM-20090614

Comment 2

[harm]

I (=reporter) can confirm this bug still exists in firefox 3.0.11

Comment 3

[Bram]

I sencond this report and it exists in 3.5.6.

It is very hard to see the difference between I and l, they only differ about two pixels in hight.

Comment 4

[David E. Ross]

Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1.6) Gecko/20091206 SeaMonkey/2.0.1

I see this in SeaMonkey 2.0.1.  This is actually an accessibility issue.  While I would prefer the use of Trebuchet, in which each Latin character is distinct, individuals with dyslexia or visual handicaps might wish to use other fonts.  Thus, this should be a user option affecting not only Password Manager but also all other product text (e.g., menu items, popup dialogs).

Comment 5

[Bruno 'Aqualon' Escherl]

Since this was seen in Firefox and SeaMonkey I'll move it to the toolkit component.

Comment 7

[David E. Ross]

A work-around is to install and use the Theme Font & Size Changer extension from addons.mozilla.org.  However, no extension should be considered a final, complete solution to this bug as subsequent changes in Toolkit might cause an extension to become incompatible.

Comment 9

[harm]

workaround: you can copy/paste the password

Comment 10

[nobody]

(In reply to harm from comment #9)
> workaround: you can copy/paste the password
In most cases when this is an issue, the reason the user is trying to read the password is just because copy and paste won't work - for example because the user is entering the password on an other device which doesn't have Firefox or doesn't have the passwords synced.

Comment 11

[Craig Markwardt]

Possible duplicate bug #511908

Comment 13

[David E. Ross]

(In reply to David E. Ross from comment #7)
> A work-around is to install and use the Theme Font & Size Changer extension
> from addons.mozilla.org.  However, no extension should be considered a
> final, complete solution to this bug as subsequent changes in Toolkit might
> cause an extension to become incompatible.

Very recent problems with Theme Font & Size Changer 48.4 -- resulting in version 48.5 -- prove my assertion that extensions should be considered only temporary work-arounds for resolving bugs.

Comment 14

[Matthew N. [:MattN]]

Hi David, feel free to submit a patch to make the password column use a different font.

https://dxr.mozilla.org/mozilla-central/source/toolkit/themes/shared/passwordmgr.css is the CSS file and you would want a selector like `treechildren::-moz-tree-cell(passwordCol)`. Maybe `font-family: monospace`?

Comment 15

[gr.evocatus]

(In reply to Matthew N. [:MattN] from comment #14)
> Hi David, feel free to submit a patch to make the password column use a
> different font.
> 
> https://dxr.mozilla.org/mozilla-central/source/toolkit/themes/shared/
> passwordmgr.css is the CSS file and you would want a selector like
> `treechildren::-moz-tree-cell(passwordCol)`. Maybe `font-family: monospace`?

Actually the problem is Windows 10 (and maybe some other) default font being sans-serif making some characters in the password column undistinguishable. It's not about monospace, it's about serifs.

Comment 16

[Matthew N. [:MattN]]

Oops, yeah, `font-family: serif;` should fix that then. Let me know if anyone needs assistance making the patch. You can also find me on IRC as MattN.

Comment 17

[Craig Markwardt]

I can't speak for Windows, but on Linux and Mac OS X, monospace is a better choice.  Serif font would end up being a Times-like font that does not fit with the rest of the UI.  The default monospace on Mac and Linux both have serifs, so they do allow to distinguish the ambiguous characters.  What is the default monospace on Windows?

Comment 18

[chaitanya5398]

I have made the change regarding the font family and attached it in form of a text file.

Comment 19

[chaitanya5398]

Attachment: It is a plain text patch making the change.

Comment 20

[jassmultani2]

I would really like to work on this bug, could anybody please help me to how to start with this ?

Comment 21

[Matthew N. [:MattN]]

Hello, chaitanya5398  is already working on this.

Comment 22

[Matthew N. [:MattN]]

Comment on attachment 8794091 [details] [diff] [review]
It is a plain text patch making the change.

Review of attachment 8794091 [details] [diff] [review]:
-----------------------------------------------------------------

::: toolkit/themes/shared/passwordmgr.css
@@ +19,4 @@
>    margin-inline-end: 5px;
>  }
>  
> +treechildren::-moz-tree-cell(passwordCol) {

This doesn't actually work so I guess you didn't test the patch. From looking at [1], it seems we need to use `treechildren::-moz-tree-cell-text(passwordCol)` instead.

[1] https://developer.mozilla.org/en-US/docs/Mozilla/Tech/XUL/Tutorial/Styling_a_Tree#CSS_Selectors_for_the_Tree

@@ +19,5 @@
>    margin-inline-end: 5px;
>  }
>  
> +treechildren::-moz-tree-cell(passwordCol) {
> +	font-family: serif;

Please use two-space indents.

Comment 23

[Matthew N. [:MattN]]

Hey Ryan, on OS X 10.10.5 the default serif font for Fx on OS X seems harder to read compared to font we use for the rest of the manager. I'm also not sure if my suggestion to only change the font for the password column is acceptable.

See http://grab.by/T9uO

Comment 24

[Ryan Feeley [:rfeeley]]

I wasn't aware of the serif font proposal. I see that 1Password does it with a mono-spaced font (not serif), but on Mac at least, neither Safari nor Chrome deviate from the platform sans-serif (SF UI Text).

If mono-spaced works better than serif (and aligns with the baseline of the other text), I'm for that. But if it's no better, we should revert to sans-serif.

Comment 25

[Matthew N. [:MattN]]

(In reply to Ryan Feeley [:rfeeley] from comment #24)
> I wasn't aware of the serif font proposal.

This bug is where we're discussing the change, my screenshot was with attachment 8794091 [details] [diff] [review] applied so Nightly is still all sans-serif now.

> I see that 1Password does it with
> a mono-spaced font (not serif), but on Mac at least, neither Safari nor
> Chrome deviate from the platform sans-serif (SF UI Text).
> 
> If mono-spaced works better than serif (and aligns with the baseline of the
> other text), I'm for that. But if it's no better, we should revert to
> sans-serif.

Here are macos 10.10 screenshots with only the font differing between serif and monospace, I didn't adjust any other CSS properties compared to the other columns.

Standalone window: http://grab.by/Tc9y
In-content prefs subdialog: http://grab.by/Tc9I

What do you think? We may be able to tweak a few CSS properties, if necessary.

Comment 26

[Ryan Feeley [:rfeeley]]

Looks good! Great idea too. I don't think Linux uses Courier, but something called "monospace". Possible to see?

Comment 27

[Craig Markwardt]

(In reply to Matthew N. [:MattN] (behind on requests) from comment #25)
> What do you think? We may be able to tweak a few CSS properties, if
> necessary.

IMHO, monospace is the most readable of the options.

Comment 28

[luciano]

I'm having this same problem in firefox mobile. I also suffer from not being able to distinguish zeros and uppercase O letter.

Comment 29

[Ayush Mahajan]

Is this bug fixed? If not I would like to work on it. Please help me with how to start to work on this bug.

Comment 30

[Matthew N. [:MattN]]

Hello, this bug will be fixed in the new password management interface.

Comment 31

[Wayne Mery (:wsmwk)]

(In reply to Matthew N. [:MattN] (PM me if request are blocking you) from comment #30)

Hello, this bug will be fixed in the new password management interface.

Is there a new pw management bug# to reference?

Comment 32

[Matthew N. [:MattN]]

(In reply to Wayne Mery (:wsmwk) from comment #31)

(In reply to Matthew N. [:MattN] (PM me if request are blocking you) from comment #30)

Hello, this bug will be fixed in the new password management interface.

Is there a new pw management bug# to reference?

Not really… it was part of the initial implementation.

Comment 33

[Richard Marti (:Paenglab)]

Attachment: 242418-password-monospace.patch

Using font-family: monospace; like FX does in their password manager

Comment 34

[Alessandro Castellani [:aleca]]

Comment on attachment 9141993 [details] [diff] [review]
242418-password-monospace.patch

Review of attachment 9141993 [details] [diff] [review]:
-----------------------------------------------------------------

Looks good, thanks.

Comment 35

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/comm-central/rev/ddf247cdde78
Use a monospace font for the password field. r=aleca

Comment 36

[Ramona Gavrilescu]

Can confirm this as Verified.
Tested on OS WIN(64):
• Version 77.0a1
Build: 20200407084618

OS MAC 14
• Version 124.0a1
Build : 20240207100532

•	Version : 126.0b1
            Build: 20240422190155