unitaryfund/metriq-api

Button to show password field when creating acct/logging in

Closed this issue · 5 comments

Somewhat standard affordance, would be nice to have here.

Right, this is a good point as well. Not that PWC (paperwithcode) needs to be the gold standard, but the way in which they appear to have their login/registration is without the "show password field".

Login page:
Screen Shot 2021-08-17 at 6 31 53 AM

Register page:
Screen Shot 2021-08-17 at 6 32 02 AM

Definitely could go either way on whether we decide to include a "show password" checkbox or not. I guess since I'm on the fence, are there any particularly strong feelings towards including vs. not including? @crazy4pi314 @WrathfulSpatula

Its def a nice to have, not critical at all. I just wanted to keep a note on this, as it is something I sometimes use when I copy the wrong thing/havent copied from the password manager yet.

Believe it or not, NIST now supports Sarah's suggestion as best practice:

https://auth0.com/blog/dont-pass-on-the-new-nist-password-guidelines/#Password-Authentication-Guidelines

(It might not have, in 2000, but standards change.) Even as an accessibility feature, NIST argues that it actually increases the likelihood of a user choosing a longer or more complex password, ultimately improving security.

I think that basically obviates any need to debate.

(I might have been slightly surprised as well, @vprusso.)

(@crazy4pi314, completely tangential, but this also actually led me to catch an unrelated bug in our checkbox form field components, just now, as a result of trying to implement this. The bug is subtle, and we probably otherwise would have completely missed this, rendering the to-be-renamed "Is Higher Better?" checkbox completely ignored, so thank you for that, too!)