Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Stop Password Masking

useit.com

Post reply on HN
Print view View original

71–80 of 83 posts

Re: Stop Password Masking

#71

Post by jonb »

oddgodd wrote: post #52
shabda wrote: post #13

This is very unconventional advise. But this is Jacob Nielsen talking on usability. What he says is generally backed by very extensive testing and way more usability experience than any of us on news.YC have. You might not agree to unmask all passwords but why not this > It's therefore worth offering them a checkbox to have their passwords masked; for high-risk applications, such as bank accounts, you might even chec…

>So please think hard on this, before you dismiss this as stupid or untenable. I have. This is stupid and untenable. Problem one: Right now if I encountered a login form that didn't mask the password I would probably attribute this to incompetence, not usability. I don't think I'm the only one. Problem two: Right now all login forms work the same. The top field is the username and under that is the password field. Th…

I'm 100% in agreement with you here.

Mac OS X's Keychain Access has "show this password", and iPhone does masking but still shows you the last character you just typed for about a second.

I think these are both good compromises.

Re: Stop Password Masking

#72

Post by mgj »

pygy wrote: post #64
tezza wrote: post #42

Earlier quoted context omitted.

And would you know if they just recorded the keys your fingers pressed? I think Jakob is really onto something here.

They could record the sound of the keypresses too. They may be impossible to discriminate subjectively, but they all have a distinct signature...

Yep, see: http://www.cs.berkeley.edu/~zf/papers/keyboard-ccs05.pdf

Re: Stop Password Masking

#73

Post by ghshephard »

cruise02 wrote: post #16
Edinburger wrote: post #6

Earlier quoted context omitted.

Yes, good luck to anyone in (a) an open-plan office or (b) an office with security cameras.

or c) at a coffee shop with wi-fi.

Different problem and solution. See: http://en.wikipedia.org/wiki/Secure_Sockets_Layer

Re: Stop Password Masking

#74

Post by DanielStraight »

Bad argument #1: Masking doesn't help since someone can just watch the keyboard or use some extremely complicated and expensive analysis to determine what you are typing.

Response: This is like saying locking your door doesn't help because someone can just get a bulldozer and push it in. Sure, it's true, but you aren't locking your door to make your home impenetratable. You're locking your door to prevent casual unauthorized entry. You don't want someone to just wander in while you're away and take things without having to do any work at all. And you don't want someone to just barge in without knocking (well you might, but it's a case for locking your door). Similarly, you aren't masking passwords to make it impossible for anyone to ever know your password. You're masking passwords so you can log in to your email in front of your friends without them getting tempted to use the information they gleaned.

Also, I can type faster than most people are probably able to read a keyboard (and my passwords are not words which makes them even harder to figure out), but there is likely no one on earth who can type faster than people can read.

---

Bad argument #2: It's ok to unmask some passwords because the information isn't critical.

Response: Take the example of looking at pictures of your cat. Where are these pictures? Let's suppose they're on Flickr. Actually, it doesn't matter much. Now, does Flickr (or this other website) just allow you to view pictures? No, it also allows you to post pictures (I wouldn't want someone posting their porn pics under my account), chat with friends (DEFINITELY don't want to be impersonated there), and even CHANGE YOUR PASSWORD thereby stealing your account. If you're just talking about password protecting a directory on your computer with cat pictures, sure show the password... but anything this trivial wouldn't be password protected anyway. Simply put, if it's important enough to have a password, it's important enough to have that password masked. Otherwise, why have it at all?

---

Excellent point: Since users DO use the same password for multiple things, you don't even know or control what credentials you are giving away. You may very well give away someone's bank PIN.

Re: Stop Password Masking

#75

Post by benhoyt »

dugmartin wrote: post #60

Just put a "show password" checkbox next to it and use javascript to change the input field type from password to text.

Yeah, that'd probably be a one-liner JavaScript. Something like:

  onclick="getElementById('pwd').type='text';"
But you'd want a bit more to toggle it. Still, maybe a slightly better way -- and a way to address the security issue at the same time -- would be to show the password when you hover over the field with your mouse. Is there a way to do this easily with JS?

Re: Stop Password Masking

#76

Post by fcr »

mgrouchy wrote: post #48
fcr wrote: post #39

Earlier quoted context omitted.

not having someone look at your password over your shoulder is a requirement What I say is that sometimes this is not a requirement even if the website offers a login feature. I guess that for my online mail client I would prefer to have a masked password field. Now for my account at an online rss reader I actually don't care that much because there is nothing to protect (at least in my opinion) and no value for some…

I think being able to mask and unmask your password with a checkbox is certainly viable(as long as the masking is the default). The problem lies not with users like you who have different passwords for different applications, the problem lies with users who have the same password for all applications. That being said, that is probably beyond the scope of what the author is trying to address but is still always someth…

Fair enough. I agree that the website may expose a "global" password as you and another person said.

I guess I'll design my future login boxes with security enabled by default and unmask option for the responsible user who would need it...

Re: Stop Password Masking

#77

Post by Semiapies »

Deestan wrote: post #14
wyday wrote: post #3

Usually this guy's observations are spot on, but this is just wrong. For instance, every time I give a presentation I usually have to login to a secure site. I'm almost always plugged into an overhead projector while I'm logging in. So, not only is this guy suggesting websites change their technology, he's also suggesting users modify their behavior to be more secure. Not going to happen.

> For instance, every time I give a presentation I usually have to login to a secure site. To be fair, he did suggest that password masking was toggled by a checkbox that was ON by default.

Only in high-risk situations.

Re: Stop Password Masking

#78

Post by jodrellblank »

blhack wrote: post #53

One of the most annoying offenders of this is the windows wireless configuration utility. It refuses to let you see the WEP key that you are typing, but insists that you type it twice. If it were something like "what is your favorite flavor of popsicls" and not "type this random 58 character sting of hex", then that might be acceptable, but it isn't. Really, who is going to be standing over your shoulder and memorize…

"Windows"? "WEP"?

Current Windows (Vista) allows you to tick a box and see the WPA key as you type it (once) (it's masked by default).

Re: Stop Password Masking

#79

Post by m104 »

wyday wrote: post #3

Usually this guy's observations are spot on, but this is just wrong. For instance, every time I give a presentation I usually have to login to a secure site. I'm almost always plugged into an overhead projector while I'm logging in. So, not only is this guy suggesting websites change their technology, he's also suggesting users modify their behavior to be more secure. Not going to happen.

I liked the part where he neglected to mention any possible benefit of the current arrangement or the fact that many of us have no problem with actually being required to type well and remember stuff.

Re: Stop Password Masking

#80

Post by invaderjim »

m104 wrote: post #79
wyday wrote: post #3

Usually this guy's observations are spot on, but this is just wrong. For instance, every time I give a presentation I usually have to login to a secure site. I'm almost always plugged into an overhead projector while I'm logging in. So, not only is this guy suggesting websites change their technology, he's also suggesting users modify their behavior to be more secure. Not going to happen.

I liked the part where he neglected to mention any possible benefit of the current arrangement or the fact that many of us have no problem with actually being required to type well and remember stuff.

You mean where he says "Yes, users are sometimes truly at risk of having bystanders spy on their passwords, such as when they're using an Internet cafe.... In cases where there's a tension between security and usability, sometimes security should win."?

Typos happen even to those who can type well. And I can remember my password, but sometimes it's a matter of figuring out which password to remember. If the one I expected to work doesn't, it just be that I unknowingly mistyped it, not that it was the wrong password.

Post reply on HN