A discussion about custom fields on the Discourse signup form has led to a change to prevent users from accidentally pasting their password into a custom field. supermathie proposed the idea after a user mistakenly pasted their password into a “Pronouns” field, thinking it was a “password confirmation” field. A validation has been implemented by @nbiancasam to reject signups if the password is entered into a custom field. There is also a suggestion to apply this validation to emails, but sam wants to see it fail in the real world before making a change. However, a change to check that the password is not the email is supported.
On a forum with a custom “Pronouns” field enabled, at least one user accidentally pasted their password into the “Pronouns” box.
Presumably they were running on autopilot and pasted their password thinking it was a “password confirmation” field like we’ve been conditioned to do over the last [too many] years.
Perhaps we could help people avoid this mistake by preventing any custom fields appearing after the “Password” field.
Or, run custom fields to ensure they aren’t the user’s password… kind of a weirdly-specific thing to check though.
