FAQ(?)/Request: Reveal passwords?

[justG]

Is there an option to always display passwords? If not, I'd like to request it. I have no use at all for hidden passwords and really dislike it when applications force me to stare at bullets or asterisks.

Thanks for your consideration!

[JD]

No, there is no such option. The 'bullets' idea is standard for the display of passwords to ensure their security from prying eyes - to that end, I won't be changing this.

What you should consider, and I'm surprised you're not already, is using the Keychain to store your passwords. That way, if you need to see a password in clear text, you can do so by looking it up in the Keychain Access application. Obviously, the Keychain can only be accessed is you enter your Keychain password, so the passwords contained within it are protected.

To enable password storage in the Keychain, enable the 'Store passwords in Keychain' option in the Server Options tab of the Preferences

[justG]

I already use the Keychain to store my passwords, but viewing them is an additional couple of steps. There are all these layers of security that one person working from home simply does not need.

I'm not asking you to change the default display in the application. I use a password manager called 1Passwd. It, too, uses OS X's Keychain; however, that application offers users the option of clicking a button to show a particular password. I was just wondering if you might consider implementing something similar: either an application-wide preference (even if it's hidden) to not hide passwords, or a wee button to temporarily show it.

It appears you misunderstood me initially, thinking that I wanted you to change the default display. If that's not the case, and you "heard me the first time" and think such a function would be a waste of resources/time, I shan't argue further.  Thanks for reading. =}

[spacific]

But why do you want to see your passwords?!

Once they are entered and saved, whether in the keychain or not, you don't need them again. As JD says if you want to view your passwords later you can always do this from the keychain access. But I can't think of any reason why you would to, unless you need to use them on another computer, but then you can write them down on a bit of paper....

[justG]

I made the request because, for one reason or another, I have found myself needing to use Keychain to view my passwords, and thought it would make my life easier if I could do so from within Yummy. That's just the way it's worked out for me.

And even if I'd never had to do that, even if I'd never had a need to view a password, I'd still want to. It's a personal preference. As I stated in my initial post, that level of security is completely unnecessary for me and I find it irritating.  If my request cannot be accommodated, that's fine, Jason can say so.

[JD]

Ok, a question then: When 1Passwd allows you to view a password does it perform any sort of authentication beforehand, or does it just show you? If it's the latter I would call it a big security bug... I understand you're the only person using your Mac, so it doesn't apply to you, but in the general case...

I'm thinking - if your password is already in the keychain and the keychain is unlocked, or your authenticate to unlock it, then there's no reason not to show you the password.

[justG]

It absolutely performs authentication first. 1P creates its own keychain, which must be unlocked before it can be used. My configuration is such that I have to do this only once: directly after restarting the computer.  (It can also be locked automatically upon application exit or X minutes of keychain inactivity.) There is a tickbox called "conceal passwords," and I can tick/untick it at will. I leave it unticked, which displays my passwords without having to do anything further.

[JD]

Ok then - that makes sense. I'll think about it

[justG]

Thanks very much!

[paulc]

Ha, JD and I had this "conversation" a while back!

One thing that springs to mind... this perplexed me a tad. Let's say you have bookmarks that DO have passwords attached (stored inside) to them. And you also have one stored in your keychain. And you set Yummy to use the keychain version. AND that password gets changed (this happened to me). Under this set of circumstances, I thought I'd just change the keychain one... but I had issues logging in. I solved that problem by making sure the bookmark did NOT contain any password at all.

Then again, I'm a big believer in the keychain, especially after the Tiger update (it acquired a search ability). So from a strategy viewpoint, I'd suggest keeping you passwords in there and not in the bookmark files Yummy keeps.

[JD]

Ah you misunderstand... justG does keep her passwords in the Keychain.

The conversation you and I had was about an entirely different problem.

[guttyguppy]

I for one would love to have the passwords displayed in plain text. Just give us the option to protect us from ourselves. I'm lazy and unorganized, and I ain't gonna change, and half the sites in my list I have no clue what the password is other than a bunch of dots. Great suggestion!

[spacific]

But as I said before, if you have stored your passwords, you don't need to see them, no matter how disorganized you are. Using the keychain is a great way to become organized. Isn't that the whole point? If you do need to see your passwords -- maybe you are logging on from other software -- they can be viewed in the keychain.  So this request really mystifies me; it isn't a question of protecting you from yourselves, it is a matter of there being a good reason for password security for many people, and if the others can see only a row of stars, what does it matter? You can easily find the passwords when you really need to.

[justG]

spacific, your adamant objection to this request is what mystifies me. Nobody is suggesting that passwords be visible by default. A row of stars may not bother *you*, but it bothers *me*. Users have different needs and different ways of using an application. I neither require nor want the security offered by replacing my passwords with asterisks, so if I want the option of making them plainly visible, I fail to see why I should be inconvenienced by having to launch a separate application to look up a particular password. It's not about being able to "easily find" a password when I "really need to," it's about wanting to see my passwords like I see any other field.

[spacific]

justG, if you can persuade JD then fine, I do not have an adamant objection. What I do not understand is why! I am intrigued. And you are apparently not going to explain why you need to see the passwords, so let's leave it. I have no wish to inflame anyone, I'm just puzzled as I cannot think of a reason.  Best regards.