41–50 of 83 posts
He is sure right about the reset button though. I can't be the only one who has entered a dozen or more fields only to lose it all with an inadvertent reset rather than submit. Also, how about the iPhone compromise? It displays the last character you typed for only an instant.
Disagree. Even bullets shouldn't be displayed while the user types the password. Why should a security camera in an office know that the user's password length is ten, twelve or twenty nine characters?
Earlier quoted context omitted.
Browsers have to store the cleantext password and you can see them all here: Firefox > Preferences > Secutiry > "Saved Passwords" -> "Show Password"
Of course, but it's highly unlikely you'd accidentally expose that page to someone. I was thinking more along the lines of letting your friend use your computer to check gmail, and whoops, there's your password already in the box.
Disagree. Even bullets shouldn't be displayed while the user types the password. Why should a security camera in an office know that the user's password length is ten, twelve or twenty nine characters?
If you cover your hand, the problem space is still small enough to guess just based on where you are covering and how long for.
Only systems that do not use passwords are viable if you are being closely scrutinized. e.g. entering only selected characters from your passphrase.
This is very unconventional advise. But this is Jacob Nielsen talking on usability. What he says is generally backed by very extensive testing and way more usability experience than any of us on news.YC have. You might not agree to unmask all passwords but why not this > It's therefore worth offering them a checkbox to have their passwords masked; for high-risk applications, such as bank accounts, you might even chec…
It is bollocks until proven otherwise ;)
My God, do you even know who "this guy" is? Stop and give it a thought a bit. He is right about the point, straight on. I've been thinking about implementing it on our web app at aleveo.com like that. Let me elaborate. We all know that having a simple and usable register/login form increases signups. Let that aside, I've kicking out everything of our forms until really only the necessary. Among those things is the re…
Regardless just because he is a well respected individual does not make all his ideas "the right way".
I think people are misreading what he said and making knee jerk reactions. But, for exampl...:
> password masking doesn't even protect fully against snoopers.
Seems an irrelevant point - he doesnt weigh the security tradeoff against the supposedly improved usability. I would argue that password masking is the #1 deterrent for casual password stealers. Plus reading fast typed keys is a skill needing to be acquired. A determined thief will always find a way to get your password. The masking is deter the casual criminals (or just your co-workers etc!!)
> It's just you, sitting all alone in your office, suffering reduced usability to protect against a non-issue
For a UI designer/engineer I think this shows a whole lot of ignorance about how people use computers... does he really imagine most people use their computer this way? really?
One important point he misses is that password boxes leap out at you BY being masked. This is an important UI concept because the user knows they are logging into something "secure". It is also the expected behaviour (for better or for worse); not just a convention but an ingrained expectation! UI designers hardly ever break expectations like that in my experience ;)
In terms of not seeing what your typing: he should know a vast majority of people watch their fingers as they type. Knowing you made a mistake is a fairly natural process (yes, we have tested this).
He DOES have a very very good point about mobiles - this is a perfect example of where masking shouldnt be employed. And I suspect this is the main point he is making. But extending it to every format? No, that IS silly.
:)
Earlier quoted context omitted.
While this is true. In the general case, if your application is required to be secure, its not a choice. Don't get me wrong, usability is very important, but if your application has to be secure(and not having someone look at your password over your shoulder is a requirement), then how can you choose usability over security?
not having someone look at your password over your shoulder is a requirement What I say is that sometimes this is not a requirement even if the website offers a login feature. I guess that for my online mail client I would prefer to have a masked password field. Now for my account at an online rss reader I actually don't care that much because there is nothing to protect (at least in my opinion) and no value for some…
That being said, that is probably beyond the scope of what the author is trying to address but is still always something to consider.
And although I'll probably be shot down for this:
The iPhone OS's method of displaying the last masked character briefly before masking it is probably the best way to handle masking.
This will solve another issue related to passwords. Password confirmation. Displaying password in clear text removes the need for password confirmation field. This could be a worthwhile experiment.
Why take the risk? :)