Should we get rid of Password confirmation input?

[dgdavid]

To save me some typing, please read https://joshwayne.com/posts/show-password/ and #750 (comment)

As someone who sees the password confirmation input as an extra step in the forms, I am on the side of those who would eliminate it. However, I can see why there may be a need for it: Agama is the web interface of an installer that allows setting sensitive passwords (superuser or disk encryption, for example). In addition, the installed system won't offer the rescued Forgot password? recovery aid to help users if they mistyped their passwords during installation.

Thinking about an alternative, I'd suggest an option for letting the user review/see all set passwords before starting the installation. It is more straightforward and does not require additional steps. Unfortunately, AFAIK it isn't technically possible.

What are your thoughts? Is the password confirmation input really useful for installer users? Or is it just an inheritance that has survived just because we, as developers, are taking more care than users wish?

BTW, if we decide to keep it alive we should at least improve the "Show password" feature to have only one action for both, the password and its confirmation. It's a lot weird to have it twice for this use case too.

[balsa-asanovic]

My two cents on this is that I'd have the password confirmation removed, it's annoying, bothersome and I always sigh when I have to type the password again 😄.

Of course, this is just me. If we consider a very broad user base, there is a certain percentage of cases where the password confirmation does help you spot the error (as stated here), and when something important as a root password is typed, even this small percentage could be crucial. So considering this, maybe the password confirmation should stay.

But 😄, if the actual user base of Agama installer is considered and not the general population using the browser, the perspective on this shifts again for me. Because I can't, by any stretch of the imagination, consider someone who is installing a Linux OS, typing root or encryption passwords, etc., to be a regular Joe and, therefore, be careless enough to type wrong password given the visibility option to check it.

I may not have made this dilemma any clearer, but it's just an overview of my take on this issue.

[13werwolf13]

Let me give you my opinion:
It seemed to me that such things should be decided by the user, there should be a switch that allows you to choose between the two proposed options.

[dgdavid]

First and foremost, thanks a lot for contributing with your feedback.

Although I understand your proposal in terms of letting the user configure every aspect of a tool, we're actually looking for a simpler, straight-forward, and easy-to-use interface. Therefore, I believe we should be a little more opinionated here and provide only one method of entering and checking the password.

Furthermore, since Agama isn't a daily tool, I think it would be better avoiding the complexity of adding too much UI configuration beyond the theming (still under development) and font sizes (already possible through browser zooming). Instead, we should focus on usability and accessibility in the mid and long run.

Thanks for your understanding.

[shundhammer]

@balsa-asanovic: This is asking for disaster. You know that the password confirmation is there to protect you from your own mistakes. And that's in no way something that happens only to novice users; to the contrary, experts who do that a lot are probably even more likely to mistype the password.

This kind of plausibility check is so simple, common and old that it's really a no-brainer.

[kobliha]

Here we have to compare two things

• User mistypes the password and the system cannot boot (LUKS pass) or the user cannot login (user pass) or can't administrate the system (root pass) ... versus
• The user has to type the password twice when installing the system

The simpler UI, the better, so having a choice to have either twice the pass or pass and review icon is IMO too much. Having the possibility to review the password with an eye icon could be an option, but it can't be the only way for security reasons. Agama should be used many different environments, e.g., home, school, office but even in some environments expecting enhanced security where "reviewing" is not an option at all.

I've, for instance, seen that some registrations to new accounts requested typing e-mail twice. It's because that e-mail is used for account recovery. Annoying? Maybe, but it's more secure and you do it just once.

[dgdavid]

Looks clear that we cannot get rid of such an input. So, let's close this discussion by now.