Hi Kenny,

In this case it was kind of by design that the passwords were not masked from the admin. The idea is in cases where you need to be able to tell your customer their password so you need to see it. For example if taking a customer service phone call. Obviously its a business decision whether to allow employees to see passwords in the system so I leave it up to the business. For those with tighter security needs you can use hashed passwords which are not visible in the UI nor in the db.

I suppose the case you are working with is that you'd like to be able to manually change passwords there but want to protect from shoulder surfing and you don't really need to see the current password. I've implemented something today to make it configurable, it will be in svn trunk by tonight.

There is a new config setting:

<add key="MaskPasswordsInUserAdmin" value="true" />

I've made the default true but it allows for those cases where the admin wants to be able to see the password. Then I set it in code like this:

if (WebConfigSettings.MaskPasswordsInUserAdmin)
{
     txtPassword.TextMode = TextBoxMode.Password;
}
 

Best,

Joe

Hi Kenny,

With hashed passwords it never did display the existing password, so shoulder surfing was not possible except if they surf right at the time you are updating a password, which is what I understand was your concern. But now with it masked that is solved.

Best,

Joe