Password bubble: Lock displayed password length to 15 characters.

Password bubble: Lock displayed password length to 15 characters.

Given that this bubble pops up without user interaction, we don't want
to accidentally leak the password length by displaying a string with the
exact number of bullets.

This CL locks the string length to 15 characters.

BUG=328339

[Mike West, 2014-04-01 14:32:07]

Mind taking a look?

[markusheintz_, 2014-04-01 14:40:38]

On 2014/04/01 14:32:07, Mike West wrote:
> Mind taking a look?

In the past we discussed whether the number of bullets should match the number
of character of the password or not. We even thought about using a random number
of bullets.

We settled with the number of bullets should match because this is what we do on
the settings page as well. So having a consistent UI was the main driver of this
decision.

I'm happy to change my mind here in case PM supports this. In this case I would
also love that we change the settings page as well.

[Mike West, 2014-04-01 14:52:11]

The difference I see is that the settings page is something you have to
manually pull up. This pops up without your interaction. Leaking data in
that case is worse than in the other case.

Make sense?
On Apr 1, 2014 4:40 PM, <markusheintz@chromium.org> wrote:

> On 2014/04/01 14:32:07, Mike West wrote:
>
>> Mind taking a look?
>>
>
> In the past we discussed whether the number of bullets should match the
> number
> of character of the password or not. We even thought about using a random
> number
> of bullets.
>
> We settled with the number of bullets should match because this is what we
> do on
> the settings page as well. So having a consistent UI was the main driver
> of this
> decision.
>
> I'm happy to change my mind here in case PM supports this. In this case I
> would
> also love that we change the settings page as well.
>
>
> https://codereview.chromium.org/221003002/
>

To unsubscribe from this group and stop receiving emails from it, send an email
to chromium-reviews+unsubscribe@chromium.org.

[markusheintz_, 2014-04-01 17:05:25]

Well you have just typed the exact same number of bullets in the password box.
So nothing is displayed that is not already there.

If we change the number of bullets here we should change it on the passwords
settings page too.

It would be nice to have a consistent UI experience.

On 2014/04/01 14:52:11, Mike West wrote:
> The difference I see is that the settings page is something you have to
> manually pull up. This pops up without your interaction. Leaking data in
> that case is worse than in the other case.
> 
> Make sense?
> On Apr 1, 2014 4:40 PM, <mailto:markusheintz@chromium.org> wrote:
> 
> > On 2014/04/01 14:32:07, Mike West wrote:
> >
> >> Mind taking a look?
> >>
> >
> > In the past we discussed whether the number of bullets should match the
> > number
> > of character of the password or not. We even thought about using a random
> > number
> > of bullets.
> >
> > We settled with the number of bullets should match because this is what we
> > do on
> > the settings page as well. So having a consistent UI was the main driver
> > of this
> > decision.
> >
> > I'm happy to change my mind here in case PM supports this. In this case I
> > would
> > also love that we change the settings page as well.
> >
> >
> > <crxref style="background-image:
url(chrome-extension://ppnlfijacbhfpjgkafbeiaklmgoljooo/res/type/codereview.png);">https://codereview.chromium.org/221003002/</crxref>
> >
> 
> To unsubscribe from this group and stop receiving emails from it, send an
email
> to mailto:chromium-reviews+unsubscribe@chromium.org.

[Mike West, 2014-04-02 09:32:11]

On 2014/04/01 17:05:25, markusheintz_ wrote:
> Well you have just typed the exact same number of bullets in the password box.
> So nothing is displayed that is not already there.

The password box probably isn't rendered at the top of the screen, or opened
with an eye-catching animation. *shrug*

I honestly don't care; I'm just trying to resolve open bugs in ways that seem
reasonable so we can get this out for user testing. :)

> If we change the number of bullets here we should change it on the passwords
> settings page too.

I don't think that follows. As I mentioned above, there's likely a distinction
between my expectations when navigating to a page that I know contains password
information vs. my expectations of Chrome's behavior after I've submitted a
password to a page.

> It would be nice to have a consistent UI experience.

Meh. :)

[markusheintz_, 2014-04-04 12:55:31]

I'm not opposed to using a fixed number of bullets. For sure that's a good
thing. I only want that the Chrome UI is consistent. :)

Is this CL rendered obsolete by https://codereview.chromium.org/221853003:
Password bubble: Add a test for displayed password length. ?




On 2014/04/02 09:32:11, Mike West wrote:
> On 2014/04/01 17:05:25, markusheintz_ wrote:
> > Well you have just typed the exact same number of bullets in the
passworhttps://codereview.chromium.orgd box.
> > So nothing is displayed that is not already there.
> 
> The password box probably isn't rendered at the top of the screen, or opened
> with an eye-catching animation. *shrug*
> 
> I honestly don't care; I'm just trying to resolve open bugs in ways that seem
> reasonable so we can get this out for user testing. :)
> 
> > If we change the number of bullets here we should change it on the passwords
> > settings page too.
> 
> I don't think that follows. As I mentioned above, there's likely a distinction
> between my expectations when navigating to a page that I know contains
password
> information vs. my expectations of Chrome's behavior after I've submitted a
> password to a page.
> 
> > It would be nice to have a consistent UI experience.
> 
> Meh. :)

[Mike West, 2014-04-04 13:02:47]

On 2014/04/04 12:55:31, markusheintz_ wrote:
> I'm not opposed to using a fixed number of bullets. For sure that's a good
> thing. I only want that the Chrome UI is consistent. :)

Let's argue about it when you're back in Munich. I'm a bit confused about what
you're advocating; it'll be simpler when I can just walk over and poke you. :)

> Is this CL rendered obsolete by https://codereview.chromium.org/221853003:
> Password bubble: Add a test for displayed password length. ?

No, that CL ends up fixing the bubble's behavior for UTF16 surrogate pairs. This
CL would do something different, if we decide to run with it.