434175 - Font for password display makes 'I' and 'l' indistinguishable.

Status: RESOLVED WONTFIX

(Toolkit :: Password Manager, defect)

Description

[Thomas Roessler]

User-Agent:       Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.5; en-US; rv:1.9) Gecko/2008051202 Firefox/3.0
Build Identifier: Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.5; en-US; rv:1.9) Gecko/2008051202 Firefox/3.0

When displaying passwords in that dialogue, the Lucida Grande font makes it extremely difficult to actually distinguish 'I' and 'l' from each other. That's particularly annoying for passwords, as good passwords do not provide any useful redundancy from which one could conclude which character is which.

Please use a different font for this field, such as Monaco.

Reproducible: Always

Steps to Reproduce:
Use a password like InnlnnInnlnnI and try to read it in Lucida Grande.

Comment 1

[Justin Dolske [:Dolske]]

Hmm. To a certain degree, it's Apple's problem for having a system default font that has similar glyphs for common english characters. I'm also hesitant to start sprinkling in a different font anywhere this kind of problem might happen (usernames, url bar, error messages, etc.).

Specifying a specific font name probably isn't a good idea, but using "font-face: monospace" might be ok. Monospaced fonts tends to have more distinct glyphs, although that's not a guarantee.

I'll also note that Apple don't use a different font when displaying a password in Keychain Access.

But, OTOH... It might be reasonable to say password fields are a special case of this problem (because they're *expected* to be a jumble of characters without context to guide interpretation), so there's no slippery slope.

UX folks, opinions?

Comment 2

[Johnathan Nightingale [:johnath]]

(In reply to comment #1)
> UX folks, opinions?

No strong ones!  :)

Thomas is right that distinction can be impossible - but imo we are getting good and edge-casey here.  While you're right that monospace fonts are no guarantee, I would support moving to them as "more likely to not suck" in this instance if we can confirm that the letters are distinguishable on all 3 platforms currently.

And assuming that someone smarter about l10n issues than I confirms that flipping to monospace in the UI here isn't going to break, say, Urdu passwords.

Comment 3

[Justin Dolske [:Dolske]]

Yeah, I'm going to wontfix this for now, because the solutions look likely to risk causing other problems. It would be nice to have a universal way to specify a font to maximize differentiation between characters, but lacking such a way it's not work the effort or risk.