Privacy Violation: Shoulder Surfing

Some APIs that gather sensitive information can mishandle it by echoing it back to the user as they type it at the input prompt.

Some APIs that gather sensitive information can mishandle it by echoing it back to the user.

Example 1: The following code demonstrates a model in ASP.NET that has a password property, but does not specify the DataType as a password, meaning that by default it will be shown when displayed:

public class User
{
  [Required]
  public int ID { get; set; }
  
  public string Title { get; set; }
  
  [DataType(DataType.Date)]
  [DisplayFormat(DataFormatString = "{0:yyyy-MM-dd}", ApplyFormatInEditMode = true)]
  public DateTime DateOfEmployment { get; set; }
  
  [DataType(DataType.Currency)]
  public decimal Salary { get; set; }
  
  [Required]
  public string Username { get; set; }
  
  [Required]
  public string Password { get; set; }
  
  ...
}

Since the property Password in Example 1 did not specify the attribute [DataType(DataType.Password)], it will not be hidden by default when displayed in the UI.

Some APIs that gather sensitive information can mishandle it by echoing it back to the user as they type it at the input prompt.

Some APIs that gather sensitive information can mishandle it by echoing it back to the user.

Example 1: The following code demonstrates the TextField widget does not obscure a user's password as they type it at the input prompt:

class SelectionContainerDisabledExampleApp extends StatelessWidget {
  const SelectionContainerDisabledExampleApp({super.key});

  @override
  Widget build(BuildContext context) {
    return MaterialApp(
      home: Scaffold(
        body: Center(
          child: Column(
            children: <Widget>[
              TextField(
                decoration: InputDecoration(
                  hintText: "Please enter your password",
                ),
              ),
            ],
          ),
        ),
      ),
    );
  }
}
  

Because TextField widget in Example 1 was not instantiated with obscureText property, set to true, the password is not obscured when the user types it at the "Please enter your password: " prompt.

The identified method writes sensitive data to the screen without properly masking it first.

The identified function gathers sensitive data without disabling the option to echo it back to user at the input prompt.

Example 1: The following code demonstrates the instantiation of a password field object that does not obscure a user's password as they type it into the text field:

ViewController.h:
...

@property (nonatomic, retain) IBOutlet UITextField *passwordField;

...

ViewController.m:
...

NSString *password = _passwordField.text;

...
  

Since passwordField in Example 1 did not have its secureTextEntry property set to true, the password is not obscured when the user types it into the text field.

Some APIs that gather sensitive information can mishandle it by echoing it back to the user as they type it at the input prompt.

The identified function gathers sensitive data without disabling the option to echo it back to user at the input prompt.

Example 1: The following code demonstrates the instantiation of a password field object that does not obscure a user's password as they type it into the text field:

...
@IBOutlet weak var passwordField: UITextField!
...
let password = passwordField.text
...

Since passwordField in Example 1 did not have its secureTextEntry property set to true, the password is not obscured when the user types it into the text field.

A viewed password endangers system security.

A password need not be viewable to its owner, and must not be viewable to others. If a password is displayed in plain text, anyone in the vicinity could see and use it to compromise the system. In computer security, shoulder surfing refers to using direct observation techniques, such as looking over someone's shoulder, to get information. Shoulder surfing is particularly effective in crowded, public environments. This threat particularly applies to mobile devices, which are generally intended for use in all environments, both private and public.