Displaying of the reveal password button must be disallowed.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-34456	DTBI1035	SV-45140r1_rule	ECSC-1	Medium

Description
This policy setting allows you to hide the reveal password button when Internet Explorer prompts users for a password. The reveal password button is displayed during password entry. When the user clicks the button, the current password value is visible until the mouse button is released (or until the tap ends). If you enable this policy setting, the reveal password button will be hidden for all password fields. Users and developers will not be able to depend on the reveal password button being displayed in any web form or web application. If you disable or do not configure this policy setting, the reveal password button can be shown by the application as a user types in a password. *Note: On at least Windows 8, if the "Do not display the reveal password button" policy setting located in Computer Configuration\Administrative Templates\Windows Components\Credential User Interface is enabled for the system, it will override this policy setting.

Description

This policy setting allows you to hide the reveal password button when Internet Explorer prompts users for a password. The reveal password button is displayed during password entry. When the user clicks the button, the current password value is visible until the mouse button is released (or until the tap ends). If you enable this policy setting, the reveal password button will be hidden for all password fields. Users and developers will not be able to depend on the reveal password button being displayed in any web form or web application. If you disable or do not configure this policy setting, the reveal password button can be shown by the application as a user types in a password. *Note: On at least Windows 8, if the "Do not display the reveal password button" policy setting located in Computer Configuration\Administrative Templates\Windows Components\Credential User Interface is enabled for the system, it will override this policy setting.

STIG	Date
Microsoft Internet Explorer 10 Security Technical Implementation Guide	2015-03-26

Details

Check Text ( C-42483r1_chk )
The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer-> Security Features "Do not display the reveal password button" must be "Enabled". Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Internet Explorer\Main Criteria: If the value DisablePasswordReveal is REG_DWORD = 1, this is not a finding.

Check Text ( C-42483r1_chk )

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer-> Security Features "Do not display the reveal password button" must be "Enabled".

Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Internet Explorer\Main

Criteria: If the value DisablePasswordReveal is REG_DWORD = 1, this is not a finding.

Fix Text (F-38536r1_fix)
Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer-> Security Features "Do not display the reveal password button" to "Enabled".