Northern Delay Repay website - password field not encrypted?

YummieGummie

I've made several claims and was about to make another one for a cancelled train when I realised that, when I type into the password field, it is not encrypted:

Has it always been this like? It's a secure connection (verified by Amazon apparently) and looks like the legit website but all other websites I've used that involve entering a password do not make it visible, so something also feels not quite right.

400ixl

You mean it is not masked, rather than not encrypted?

As long as no one is looking over your shoulder it makes little difference as long as the transmission is encrypted. Just a bad UI design.

TadleyBaggie

It does appear to be poorly programmed, as said it is basic UI design that entered passwords are not displayed in clear text.

Emmia

If you're concerned, have you raised this with Northern to tell them?

DullGreyGuy

It's got nothing to do with encryption as others have said. 

In the HTML they have defined the input box as a "Text" which means you can see what you've entered whereas passwords are normally defined as "Password" and so text is masked as blobs. These days there are lots of places that have a "show password" button/icon that toggles the input box's type so you can choose to see or mask the password. 

The only difference it makes is to what you or anyone around you sees. Any key logger still gets your password, it's transmitted back to the server in the identical way irrespective if its "text" or "password". In principle you could set all the text inputs as passwords if you wanted but then people won't spot when they've mistyped their address etc.

If you are only using the site in the privacy of your own home then there is little to worry about for you... if you often fill it in whilst on the train/platform then slightly more concern. 

Flag it with them if you feel strongly, they may agree and change it or they may disagree and say its been done to support those with dexterity issues who may struggle typing passwords and so seeing what they've typed it helpful. With how IT tends to work it won't be cheap for them to change it even though it's literally just changing one word in the code.