Why is there a padlock in the password field? There probably shouldn't be.

[wjdp]

In raising this issue, I confirm the following (please check boxes, eg [X] - no spaces) Failure to fill the template will close your issue:

• I have read and understood the contributors guide.
• The issue I am reporting can be replicated
• The issue I'm reporting isn't a duplicate (see FAQs, closed issues, and open issues).

How familiar are you with the codebase?:

1

---

Issue type: Other (Design/UX?)

[BUG | ISSUE] Expected Behaviour:

Padlocks are synonymous with SSL/TLS/HTTPS/generally secure things. Placing one in the body of the page is used by many sites (mainly e-commerce) to attempt to raise the user's perception of the site's security. When used on a site that does not employ TLS it's heavily misleading to include a padlock.

Expected behaviour: do not show a padlock on the page, especially when TX/RX over plain HTTP.

[BUG | ISSUE] Actual Behaviour:

The password field in the 'log in' dialogue shows a padlock:

The page has been loaded over plain HTTP. When submitting the form the password is sent in-the-clear:

In addition when an incorrect password has been entered a red padlock is shown:

This coloured symbol is used in-browser to represent a broken HTTPS page. Again misleading, just in a different way.

This is software whose users run and maintain themselves. There is no incentive to 'lie' to them about the security of the web interface. Instead be honest about it and let them make informed decisions about how they want to use it.

Sidenote: I'm sure the intention was not to deceive (again what would be the point?), not raising any accusation. This is just a bugbear of mine.

References (first Google result for "misuse of padlock symbol" 😄): https://www.troyhunt.com/padlock-icon-must-die/

[BUG | ISSUE] Steps to reproduce:

Use the login flow.

[PromoFaux]

Thanks for the comments! The intention is certainly not meant to decieve :) If you can suggest a better icon to represent 'password' then please do

[DarkMatterMatt]

A key?

[wjdp]

Think I saw you were using font awesome. The asterisk (fa-asterisk) I would think could work.

Though I would argue that a symbol in this field is unnecessary.