HalfMask - an Experiment in Password Masking • Hacker News Board

Re: HalfMask - an Experiment in Password Masking

#21

Post by jf » Wed, Jul 08, 2009, 11:08 PM UTC

bcl wrote: post #13

umbrae wrote: post #9

Hey guys, I'm the author of HalfMask - please let me know if you have any feedback, or you can check out the source on google code: http://code.google.com/p/halfmask/ Forking to try new things is heartily encouraged - I'd like to see new approaches to password masking.

The masking characters need to be more similar to the characters being typed. eg. ll is easily readable with letters like nrs, etc. in the background.

I agree, it's pretty easy to read the text if you zoom in on the field: http://skitch.com/joelf/bayjs/halfmask

Re: HalfMask - an Experiment in Password Masking

#22

Post by nirmal » Wed, Jul 08, 2009, 11:40 PM UTC

I modified his code to do the iPhone style masking. It masks everything except the last character. Demo page is unmodified. You can see it here: http://nirmalpatel.com/hacks/halfmask/demo.html and a diff of the code: http://nirmalpatel.com/hacks/halfmask/jquery.halfmask.js.dif...

Re: HalfMask - an Experiment in Password Masking

#23

Post by TweedHeads » Thu, Jul 09, 2009, 12:00 AM UTC

In the comfort of my privacy I want to see what I am typing.

There is nobody shoulder surfing, no cameras recording me.

A check box for unmasking will suffice.

Cool hack nonetheless.

Re: HalfMask - an Experiment in Password Masking

#24

Post by gojomo » Thu, Jul 09, 2009, 12:33 AM UTC

tptacek wrote: post #16

Let me just say, as retarded as I think this whole masking kerfluffle is, play with it or don't play with it, but if you don't mask passwords in your login box, expect to spend $10,000-$20,000 extra to your PCI auditors (and then restore password masking) when you decide to accept credit cards.

I don't think anyone has suggested individual sites should override the browser behavior.

The interesting question is whether client software (browsers/add-ons) should offer another option. And if it did, would the Payment Card Industry auditors demand a site override the user's choices, for example by simulating a masking password field outside the default HTML widgets?

Re: HalfMask - an Experiment in Password Masking

#25

Post by TravisLS » Thu, Jul 09, 2009, 1:12 AM UTC

My main issue with this solution is that it takes the decision out of the user's hands. Granted, in some cases it is potentially beneficial to unmask the password, but I would not want a site to assume that I'm okay with this approach. Imagine if you have to type in a password presenting in front of a crowd of 100 people. Do you feel secure with this solution?

Whatever solution you implement, it's important to give the user explicit control to override the mask.

Re: HalfMask - an Experiment in Password Masking

#26

Post by zackattack » Thu, Jul 09, 2009, 1:56 AM UTC

tptacek wrote: post #16

Let me just say, as retarded as I think this whole masking kerfluffle is, play with it or don't play with it, but if you don't mask passwords in your login box, expect to spend $10,000-$20,000 extra to your PCI auditors (and then restore password masking) when you decide to accept credit cards.

What are PCI auditors?

Re: HalfMask - an Experiment in Password Masking

#27

Post by tptacek » Thu, Jul 09, 2009, 2:15 AM UTC

zackattack wrote: post #26

tptacek wrote: post #16

Let me just say, as retarded as I think this whole masking kerfluffle is, play with it or don't play with it, but if you don't mask passwords in your login box, expect to spend $10,000-$20,000 extra to your PCI auditors (and then restore password masking) when you decide to accept credit cards.

What are PCI auditors?

PCI stands for "Payment Card Industry", and is a shorthand for the PCI Data Security Standards, which are a set of rules that every vendor above a certain size has to follow in order to process payments with a Visa or Mastercard.

PCI auditors are people working for one of the 20-30-odd firms that are certified by Visa to audit compliance to the PCI DSS.

Re: HalfMask - an Experiment in Password Masking

#28

Post by cliffdickerson » Thu, Jul 09, 2009, 3:06 AM UTC

umbrae wrote: post #9

Hey guys, I'm the author of HalfMask - please let me know if you have any feedback, or you can check out the source on google code: http://code.google.com/p/halfmask/ Forking to try new things is heartily encouraged - I'd like to see new approaches to password masking.

I typed a password, It "stood out" so I had my wife see if she could read it and she couldn't. I had her type a password and I could read it no problem. once she had typed it she could read mine no problem as well. It seems once you've "seen it" it stands out. Sorry, maybe I missed something?

Still cool JS trickery none the less.

Re: HalfMask - an Experiment in Password Masking

#29

Post by [deleted] » Thu, Jul 09, 2009, 4:51 AM UTC

tptacek wrote: post #27

zackattack wrote: post #26

Earlier quoted context omitted.

What are PCI auditors?

PCI stands for "Payment Card Industry", and is a shorthand for the PCI Data Security Standards, which are a set of rules that every vendor above a certain size has to follow in order to process payments with a Visa or Mastercard. PCI auditors are people working for one of the 20-30-odd firms that are certified by Visa to audit compliance to the PCI DSS.

[deleted]

Re: HalfMask - an Experiment in Password Masking

#30

Post by sirrocco » Thu, Jul 09, 2009, 5:20 AM UTC

umbrae wrote: post #9

Hey guys, I'm the author of HalfMask - please let me know if you have any feedback, or you can check out the source on google code: http://code.google.com/p/halfmask/ Forking to try new things is heartily encouraged - I'd like to see new approaches to password masking.

If you select the text the password is clearly visible. Plus the letters I type are slimmer than the mask so I can still see the password.

I say : just mask the bloody password the old fashioned way :)