_:n539c8b620c424cd6883c5489388f1871xb3
<http://schema.org/text>
"You have identified a key weakness of the HTTPS protocol, that the protection only applies to the wire between your computer and the server. In fact, not even all of that wire if a proxy is used. The other factor is that browsers provide no inbuilt way to encrypt data entered into form fields. This data is always sent in plaintext. You can code an encryptor with Javascript, but it would be better if there was an inbuilt mechanism that disallows access to the field contents until the encryption has been applied. I raised this idea with Mozilla, but it seems they prefer to rely solely on HTTPS. The consequences are that any process running in the same browser context as the form field (for example, advertising) can read the plaintext password. Also, since the password is automatically decrypted on arrival at the server, re-encrypting it with C#, PHP or whatever may do no good if malware running on the server has already seen it. http://iwrconsultancy.co.uk/blog/https"
<https://frontend.spiceworks.com/topic/2119096-c-web-api-login-information-in-plain-text?page=1#entry-7605055>