Browser behaviour in "Change Password" ADSelfService

Question

In https://adselfservice.\*\*\*\*\*\*\*/HomeAction.aspx?id=a269d548-4ea2-4f88-****-********
We get different behaviour from Internet Explorer 11 vs other browsers with regard to password masking.
In IE8 and Chrome the passwords are masked by default.
In IE11 the passwords are not masked by default.
Is there an Adaxes configuration that will ensure the passwords are masked by default regardless of browser?

Comments

Hello,

That's strange. We've re-checked this in our environment, and passwords are masked by default in IE11. Are there any settings that would enable automatic password generation, for example, with the help of a Property Pattern? Could you also post here a screenshot of the page?

---

I did some retesting and it is actually IE8 that has the different behaviour. IE11 and Chrome are the same.
To clarify, the difference occurs when the user selects the "Generate" button.
With IE8 the new password fields are masked and a separate popup box displays the password in plain text. Clicking on the screen anywhere will quickly hide the plain text.
With the other browsers the the new password fields display plain text.
I suspect this is by design, but my security folks are complaining that the passwords are displayed in plain text.
Security would prefer the password are masked by default.

Answer 1

Hello,

Actually, we did that for purpose, because the new password is generated by Adaxes automatically. How would users know their new password if it is masked? Of course, they can click on the eye button to view the password in the hint, like in IE8, but what's the difference if they need to view the generated password anyway?

As for the difference between IE8 and other web browsers, IE8 has been developed quite a while ago, and sometimes it is impossible to achieve the same behavior as with newer browsers.

Comments

So this is not configurable?
Is there an Adaxes configuration that will ensure the passwords are masked by default regardless of browser?

---

Sorry, missed that one.

No, this is not configurable.