[whatwg] <input type="password">... restrict reading value from JS?

[Bjartur Thorlacius]

Þann mán  1.ágú 2011 15:25, skrifaði Aryeh Gregor:
> If you're doing useful password strength checks, regular expressions
> won't cut it.  For instance, you'll want to check against
> dictionaries.  Regex is only useful for crude and ineffective checks
> like "must be at least six characters long with mixed-case letters,
> numbers, and punctuation" (= "Abcd0!" is okay,
> "effervescentarcheopteryxattack" is not).
>
My point is that a sites aren't going to distribute JavaScripts that 
fetch a cracklib dictionary and look the password up in it. A cracklib 
may be available to the user agent, in which case the UA can look the 
typed in password up. Unfortunately, the UA probably won't know if the 
password is input for registration or login, but that can be worked 
around with "Don't warn me again" buttons on the passive warnings. And 
even if you want to allow authors to recommend dictionaries, doing so on 
as high level as possible (i.e. declaratively) simplifies caching, 
especially important where a cache miss will be an exception.

> JavaScript acts as the agent of the receiving server.  This is a
> cornerstone of the web security model.  The server is what sent you
> the JavaScript, so it's trusted to act on behalf of the site.  There's
> no way you're going to paper this over by trying to remove one or two
> minor privileges from JavaScript.  (Yes, there are a few cases where
> we do this as an XSS defense-in-depth measure, like HttpOnly cookies,
> but only for very narrow things where it makes sense.)
>
Indeed.

>> This is one of the reasons some people disable
>> JavaScript. Most don't, as they don't want to stop JavaScripts from
>> doing other more useful things. If we disable just stuff like this we
>> can bring some security to the folks that have JavaScript enabled
>> (such as me).
>
> No you can't.  JavaScript can replace arbitrary page content.  You
> can't work around that without crippling it.
>
As I suspected.

>> Are XHR submits of passwords common and important enough to outweigh
>> the security cost of scripts having access to all passwords in their
>> document(s)?
>
> Yes.  We can't stop them without breaking the web.
>
>> I propose disallowing changing the action attribute of forms with
>> password inputs.
>
> We can't do that without breaking the web.  There are going to be
> countless sites that rely on being able to create forms in JavaScript,
> which includes setting their action attribute and includes forms with
> password inputs.
Ok. I'll use HTTP authentication methods or HTML login forms in a 
dedicated document (linked to with sandboxing where applicable).