31–36 of 36 posts
Let me just say, as retarded as I think this whole masking kerfluffle is, play with it or don't play with it, but if you don't mask passwords in your login box, expect to spend $10,000-$20,000 extra to your PCI auditors (and then restore password masking) when you decide to accept credit cards.
On our signup for our time tracking app, Freckle (http://letsfreckle.com), we just left the password fields clear.
Number of signups: >4000. Number of people who complained: 4. Number of people who wrote nice things: 15.
Translation: people like it, but it's not really remarkable. (And we did it 6 mos before the Man Who Would Be King wrote about this idea.)
Let me just say, as retarded as I think this whole masking kerfluffle is, play with it or don't play with it, but if you don't mask passwords in your login box, expect to spend $10,000-$20,000 extra to your PCI auditors (and then restore password masking) when you decide to accept credit cards.
I don't think anyone has suggested individual sites should override the browser behavior. The interesting question is whether client software (browsers/add-ons) should offer another option. And if it did, would the Payment Card Industry auditors demand a site override the user's choices, for example by simulating a masking password field outside the default HTML widgets?
The HTML 4.01 spec doesn't dictate how passwords should be obscured, although it does suggest asterisks. I think it would be reasonable for browser vendors to provide an alternative means of obscuring passwords.
If the PCI auditors aren't happy with this, and given the leniency of the HTML 4.01 spec (I haven't checked any other specs), should they take this up with the W3C?
I modified his code to do the iPhone style masking. It masks everything except the last character. Demo page is unmodified. You can see it here: http://nirmalpatel.com/hacks/halfmask/demo.html and a diff of the code: http://nirmalpatel.com/hacks/halfmask/jquery.halfmask.js.dif...
Let me just say, as retarded as I think this whole masking kerfluffle is, play with it or don't play with it, but if you don't mask passwords in your login box, expect to spend $10,000-$20,000 extra to your PCI auditors (and then restore password masking) when you decide to accept credit cards.
Just do what the overly paranoid security industry says. They'll never steer you wrong!
Hey guys, I'm the author of HalfMask - please let me know if you have any feedback, or you can check out the source on google code: http://code.google.com/p/halfmask/ Forking to try new things is heartily encouraged - I'd like to see new approaches to password masking.
jQuery implementation here: http://blog.decaf.de/2009/07/iphone-like-password-fields-usi...