Currently, users can write custom unmask selectors to unmask passwords, meaning their users' passwords can be visible in clear text if the website for instance provides a "View Password" funcitonality.
IMO, under no circumstances whatsoever, never! (yup, feeling strongly about this) should we allow this to happen.
After chatting a little bit about this, the probably best way to block this type of unmasking, is to change the unmasking behaviour in rrweb. We should investigate how to handle this best.
Currently, users can write custom
unmaskselectors to unmask passwords, meaning their users' passwords can be visible in clear text if the website for instance provides a "View Password" funcitonality.IMO, under no circumstances whatsoever, never! (yup, feeling strongly about this) should we allow this to happen.
After chatting a little bit about this, the probably best way to block this type of unmasking, is to change the unmasking behaviour in rrweb. We should investigate how to handle this best.