16

Safari 12.0.1 (14606.2.104.1.1) / macOS Mojave 10.14.1 (18B75) / both Mac Mini late 2018 and macBookAir late 2018.

Each time I type a character in a password field, instead of being displayed as a unique dot, it generates lots of dots after a micro-delay. I know it's hard to believe, but in the first example below, I have actually typed one single character; in the second one, two characters:

I have typed ONE character

I have typed TWO characters

  • Same behavior on any web page with a password field.
  • Safari only. No problem on Chrome or Firefox.
  • Asking 1Password to fill in the field works. BTW, I thought 1Password was the culprit, but disabling its extension had no effect.
  • Deleting type="password" with Safari's inspector makes the problem disappear, but of course that reveals the typed characters.

So I am left scratching my head. Any lead?

  • Does it really matter? Is your password being correctly sent to the server, or is an incorrect string being generated? – Carl Witthoft Jan 23 at 16:45
  • It's the incorrect string which was generated. For instance, if the shortcut was defined as "foobar ", and my password was "love123" (oops!), the password actually sent to the site was "foobar foobar foobar ... foobar". – Aristide Jan 23 at 16:56
36

Found it, my fault. I had recently defined a system-wide shortcut associating the symbol "•" to another string. Worst idea ever! As soon as a dot appeared, it was expanded to several characters, all replaced by dots, and so on. Since I usually use 1Password, I only hit the issue a few days after the fact.

Now there's something on the internet in case somebody makes the same mistake :)

  • 6
    Question can only be marked resolved after a self-answer once 2 days have passed.... – Roddy of the Frozen Peas Jan 22 at 16:05
  • 20
    I'm confused how such shortcuts can even possibly apply to a character that isn't actually typed, only shown on screen. – grawity Jan 22 at 16:54
  • 3
    If the field's value stays accurate, it seems like a nice mitigation against shoulder surfing. Not a really strong defense, but just another defense. – mgarciaisaia Jan 22 at 19:12
  • 8
    @mgarciaisaia - I've used software that, if I type hunter2 in the password field, I get an almost random number of "dots" showing up on screen. So typing just h might show ••• then u may show , etc...so the length of the password is not same as length of the obfuscated password showing on the screen. I've always wondered why that's not more widespread. – BruceWayne Jan 22 at 19:19
  • 14
    Sorry - I only see ******* in your first line. Seems StackExchange is filtering out your password :O – mgarciaisaia Jan 22 at 19:22

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .