After a password is decrypted, it is displayed in the Account View page in plain HTML. This means the page and, therefore, the password are cached on the local computer. It would be easy to use a browser's history or even just the back button to view the password. I believe this is a major security flaw, but I'm not quite sure how to fix it.
2007-11-16 15:20:15 UTC in phpPasswordManager
