Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Stop Password Masking

useit.com

Post reply on HN
Print view View original

31–40 of 83 posts

Re: Stop Password Masking

#31

Post by mgrouchy »

fcr wrote: post #26
mgrouchy wrote: post #15

Unfortunately usability doesn't necessarily coincide with security. If you have to choose between the two, security always wins.

I have to disagree. Who wins between usability and security depends on the application you're using/building. Rarely there is one good solution to fit all problems.

While this is true. In the general case, if your application is required to be secure, its not a choice.

Don't get me wrong, usability is very important, but if your application has to be secure(and not having someone look at your password over your shoulder is a requirement), then how can you choose usability over security?

Re: Stop Password Masking

#32

Post by [deleted] »

shabda wrote: post #13

This is very unconventional advise. But this is Jacob Nielsen talking on usability. What he says is generally backed by very extensive testing and way more usability experience than any of us on news.YC have. You might not agree to unmask all passwords but why not this > It's therefore worth offering them a checkbox to have their passwords masked; for high-risk applications, such as bank accounts, you might even chec…

[deleted]

Re: Stop Password Masking

#33

Post by chaosmachine »

slig wrote: post #20
chaosmachine wrote: post #8

Combine this with the "remember password" feature of most browsers, and you have a real problem.

Browsers have to store the cleantext password and you can see them all here: Firefox > Preferences > Secutiry > "Saved Passwords" -> "Show Password"

Of course, but it's highly unlikely you'd accidentally expose that page to someone. I was thinking more along the lines of letting your friend use your computer to check gmail, and whoops, there's your password already in the box.

Re: Stop Password Masking

#34

Post by subbu »

This will solve another issue related to passwords. Password confirmation. Displaying password in clear text removes the need for password confirmation field. This could be a worthwhile experiment.

Re: Stop Password Masking

#36

Post by jsonscripter »

wyday wrote: post #3

Usually this guy's observations are spot on, but this is just wrong. For instance, every time I give a presentation I usually have to login to a secure site. I'm almost always plugged into an overhead projector while I'm logging in. So, not only is this guy suggesting websites change their technology, he's also suggesting users modify their behavior to be more secure. Not going to happen.

This sounds like something that should be handled by the user agent on the user's request.

Re: Stop Password Masking

#37

Post by Deestan »

apgwoz wrote: post #24
Deestan wrote: post #10

At least when setting or changing passwords, I would like an option to display them in clear text. Slightly on-topic: I find it silly for a shopping website to display your complete credit card information in plain letters on screen, while masking your login password. The credit card info can be misused to empty your bank account, while the login password can be misused to ... what? Send obscene support requests and…

> Send obscene support requests and muck about with your digital shopping cart? That, and if your credit card is stored on their servers, which your statement implies, it'd be easy for me to buy stuff on behalf of you. Right now, I'm buying you a new 72 inch Plasma screen which you can't afford. Have fun returning it! Of course, I could send that plasma to myself, but it'd be stupid of me to do so, since I'd be givin…

> if your credit card is stored on their servers, which your statement implies

No, I did not intend to imply that.

The places where I do most my shopping, I have to (or prefer to, in the case of Amazon) enter credit card information on a per-purchase basis.

Re: Stop Password Masking

#38

Post by matthardcastle »

I look forward to the day when an option other than passwords become viable. Have you ever looked at a typical users password? Run john the ripper over you're users passwords field and prepare to be frighted. If you don't store them hashed just take a look at them.

The fact is we need a better option both for security and usability.

Re: Stop Password Masking

#39

Post by fcr »

mgrouchy wrote: post #31
fcr wrote: post #26

Earlier quoted context omitted.

I have to disagree. Who wins between usability and security depends on the application you're using/building. Rarely there is one good solution to fit all problems.

While this is true. In the general case, if your application is required to be secure, its not a choice. Don't get me wrong, usability is very important, but if your application has to be secure(and not having someone look at your password over your shoulder is a requirement), then how can you choose usability over security?

not having someone look at your password over your shoulder is a requirement

What I say is that sometimes this is not a requirement even if the website offers a login feature.

I guess that for my online mail client I would prefer to have a masked password field.

Now for my account at an online rss reader I actually don't care that much because there is nothing to protect (at least in my opinion) and no value for someone to steal and remember my password. Maybe however I still want to be protected against someone on the web who happens to have the same name as I do and wants to steal my account... However the probability for this guy to be over my shoulder is quite low.

Maybe this is all a question of personal interest. Some users will prefer usability over security while others will prefer the opposite no matter the application. If this is the case then I would vote for having the option to toggle between one and the other...

Re: Stop Password Masking

#40

Post by khandekars »

mooism2 wrote: post #27
khandekars wrote: post #11

Disagree. Even bullets shouldn't be displayed while the user types the password. Why should a security camera in an office know that the user's password length is ten, twelve or twenty nine characters?

If you have a well chosen password and it is that long, knowing how long your password is won't be enough for the office snoop to crack the password. I'd be more worried about the camera watching which keys I'm pressing. On the other hand, if I start typing my password too soon after the login box appears on my laptop, it eats the first character. I would never have worked out why I was finding it so hard to login if…

Dodgy keyboard is a good point; makes for a compelling case in favour of bullets.
Post reply on HN