<html><head><meta http-equiv="Content-Type" content="text/html; charset=us-ascii"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class=""><div><blockquote type="cite" class=""><span style="font-family: "Helvetica Neue", Helvetica, Arial, sans-serif; font-size: 16px;" class="">It's often the case for me that I paste both [username and password] into the slots. When I did not have a fixed order, about once or twice a year I would paste the password into the username slot, whence it would be displayed in the clear....</span></blockquote>If someone is looking over your shoulder, you should not be entering your password - after all, it was visible in the clear wherever you copied it from!</div><div><br class=""></div><div>In most cases, you can easily clear the information off the screen. It was harder back in the days of teletypes where what you typed was on a piece of paper.... :-)</div><div><br class=""></div><div>Proper design - for as long as people have talked about proper design for username/password handling - is to *never* log a failed username anywhere, exactly because this kind of inversion is a very common failure mode.</div><div><br class=""></div><div><blockquote type="cite" class=""><div class=""><div class=""><div class="yahoo-style-wrap" style="font-family:Helvetica Neue, Helvetica, Arial, sans-serif;font-size:16px;"><div dir="ltr" data-setdir="false" class=""><div class="">To avoid this, I now have a rule: always enter the username first, then the password. If you put the un into the pwd slot, the non-displaying will alert you.<br class=""><br class="">That's fine, but... Now the password is left in the copy/paste buffer, and can pop out when you are not expecting it. This is the lesser of the two evils. I have another rule: over-write the copy/paste buffer right after doing the password.<br class=""></div></div></div></div></div></blockquote>On a Mac it's possible to write programs to record what goes into the copy/paste buffer, and there are many useful versions out there that let you go back and grab old entries. There was also a bug - recently fixed - that, in some circumstances, allowed apps on your iPhone to grab the contents of the paste buffer. (It's still possible to do this - in fact, it's a feature of the integration between different Mac/iOS systems - but you're now informed when it happens.)</div><div><br class=""></div><div>So ... I personally try to avoid copying passwords. Rather, I drag and drop them into the password field - an operation that doesn't put them in the paste buffer. (Whether there is some other way for a program to grab them, I don't know - but it's certainly not something I've seen done.)</div><div><br class=""></div><div>I can't speak to Windows, or to any of the variety of Unix desktops out there, which don't necessarily all behave the same way.</div><br class=""><div class=""><div class=""> -- Jerry</div></div><div class=""><br class=""></div></body></html>