Title

The application must not display passwords/PINs as clear text. (Cat I impact)

Discussion

To prevent the compromise of authentication information such as passwords during the authentication process, the feedback from the information system must not provide any information that would allow an unauthorized user to compromise the authentication mechanism. Obfuscation of user-provided information when typed into the system is a method used in addressing this risk. For example, displaying asterisks when a user types in a password is an example of obscuring feedback of authentication information. Another method is to display authentication feedback for a very limited time, usually in fractions of a second. This occurs during password character entry where the password characters are displayed for a very small window of time and then automatically obfuscated. This allows users with just enough time to confirm their password as they type it while limiting the ability of "shoulder surfers" to covertly witness the values. A common tactic employed to circumvent password obfuscation is to copy the obfuscated password and paste it to a text file. Proper obfuscation techniques will not paste the clear text password.

Check Content

Ask the application admin to log on to the application. Observe the authentication process and verify any display feedback provided when the admin enters her/his password is obfuscated and not clear text. For applications that display authentication feedback for a very limited time, ensure the feedback time the character is displayed is only momentary i.e., fractions of a second. Using a text editor, copy the obfuscated password and paste to a text file. Do not save the file. If the application displays clear text when the password/PIN is entered, or if the time period for displayed feedback exceeds fractions of a second, or if the clear text password/PIN is displayed when pasted, this is a finding.

Fix Text

Configure the application to obfuscate passwords and PINs when they are being entered so they cannot be read. Design the application so obfuscated passwords cannot be copied and then pasted as clear text.

Additional Identifiers

Rule ID: SV-222554r879615_rule

Vulnerability ID: V-222554

Group Title: SRG-APP-000178

Expert Comments

CCIs tied to check.

Controls tied to check. These are derived from the CCIs shown above.