Enhance web UI for password protection

[MacSass]

The current UI for protecting the web UI of a device (in configuration - configure other) is confusing and not clear.
It does not provide clear indication if a password is set or not ...

There is a checkmark toggle, that toggles the password entry field between dots and stars (*) for whatever reason, but even if a password has been set, the checkmark get´s unselected after reboot. Totally confusing ...

I would propose to handle password protection like the the "template" setting in the same dialogue. Meaning:
Make a section "Password protection" with the entry field for the password, and a checkmark below it with "Activate password protection". That checkmark should allways be checked, when an active pw is set on the device and unchecked when there is not pw protection. An additional checkbox to toggle between hidden (***) or clear text might be considered for the pw entry field.

The current implementation confused me and I have seen two friends not getting it either ...

Regards - MacSass

[barbudor]

The checkmark is not representative of the password status. It is exactly what you are suggesting later to make password clear text when entering a new value.
However after the reboot, for security reasons, the password is never shown on the web GUI. This is why checking the "clear-text" box shows stars instead of the actual value.
This is quite a common way of handling passwords on many devices and softwares.

Normally you should know when a password is active as you had to enter it to reach this menu.

[MacSass]

Hi, thanks for the explanation - but still this is everything else than obvious to me and I would guess many others.
A clearer "password set" checkmark seems desireable from my point of view.
Also I don´t really see why the current checkmark does not show the real password after reboot - as I had to authenticate to get to the dialogue anyhow, as you state. At a minimum it should be labled something like "reveal" or similar as most will think it indicates if PW is set or not.
For me this part of the UI clearly is not intuitive and I think it should be improved - one way or the other ...
Regards - MacSass

[sfromis]

It is pretty common for password entry forms to never display the stored password. One user could log in with the password, and then another user could spy what it is. This may be worse than just changing it, as the knowledge could be used later when the login is presumed to be locked.

Actually, good password security (which Tasmota does not have) means that a cleartext password is never stored, only a hash to allow verification, but not password recovery.

[MacSass]

Hi,
I understand those points, while some application handle password masking like this, others do differently. But I guess I could live with how passwards are not shown ... just the checkbox linked to the field does not have any indication what it is for, as well as there is no visible indication if a PW is set at all.

The unconsious user will think that the checkbox does exact that: Enable or disable PW activation.
At a minimum there should be something like "show pw" in front of this checkbox.
Also at minimum I would say to keep the field blank if no PW is set. E.g. like this (here no PW is set currently):

Changes for this should be minimal.

From my point of view a more user friendly and clear UI could look like this:

Obviously that will require some changes - could you invision that to be possible?

Best regards - MacSass