
Prevent password leaking
-------

**Description:**

Whenever an users password is displayed on screen or send by email, an attacker gains the 
opportunity of compromising the password since it is displayed or sent in plain text. 
Since the password is displayed on screen it could even be copied simply by looking at it.


**Solution:**

Never display passwords on screen in an unprotected matter since this could easily lead 
to the password being compromised. 
Some practises are for you to: 

set input field type to password. 

Set autocomplete=off for the password input field. 
This turns off the auto complete and remember password features of the browser.
**NOTE:** for some browsers this means you have to put al the input fields the form contains
to autocomplete=off, otherwise it will not comply.

Also whenever a user has the opportunity to use password forget functions
you should send a reset link rather than a new auto-generated password.




