Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Stop Password Masking

useit.com

Post reply on HN
Print view View original

51–60 of 83 posts

Re: Stop Password Masking

#51

Post by apgwoz »

Deestan wrote: post #37
apgwoz wrote: post #24

Earlier quoted context omitted.

> Send obscene support requests and muck about with your digital shopping cart? That, and if your credit card is stored on their servers, which your statement implies, it'd be easy for me to buy stuff on behalf of you. Right now, I'm buying you a new 72 inch Plasma screen which you can't afford. Have fun returning it! Of course, I could send that plasma to myself, but it'd be stupid of me to do so, since I'd be givin…

> if your credit card is stored on their servers, which your statement implies No, I did not intend to imply that. The places where I do most my shopping, I have to (or prefer to, in the case of Amazon) enter credit card information on a per-purchase basis.

I considered for a moment the possibility that you were referring to entering your credit card numbers without masking, and probably should have deduced that given the context.

Re: Stop Password Masking

#52

Post by oddgodd »

shabda wrote: post #13

This is very unconventional advise. But this is Jacob Nielsen talking on usability. What he says is generally backed by very extensive testing and way more usability experience than any of us on news.YC have. You might not agree to unmask all passwords but why not this > It's therefore worth offering them a checkbox to have their passwords masked; for high-risk applications, such as bank accounts, you might even chec…

>So please think hard on this, before you dismiss this as stupid or untenable.

I have. This is stupid and untenable.

Problem one: Right now if I encountered a login form that didn't mask the password I would probably attribute this to incompetence, not usability. I don't think I'm the only one.

Problem two: Right now all login forms work the same. The top field is the username and under that is the password field. This would break that consistency by adding the "show (or hide) password" behavior. In his description he even suggests that some sites default to a different behavior based on some notion of degree of security. Now logging in with someone looking on becomes quite a bit more nerve-wracking because you need to figure out if the password field will disclose your password. This is less usable.

Now, where I think this may be useful is if it is added as part of the "invalid password" behavior. Offer to give the user help only if they need it. Provide them a button to show the password they entered, and allow them to try again underneath it to fix any typos or verify that they correctly entered the password they were thinking of. This helps the user without changing the way the login form operates in the default case where a correct password is entered (a password that's probably in the user's muscle memory because they use it for everything). I know I've actually seen this done somewhere, although I can't remember where.

Mobile is a bit different. I’m completely behind the times in using a mobile device to access the web, but I know that my terribly slow phone running its gimped browser (netfront, I think?) on its tiny screen quite a few years ago provided the option to display masked fields in the editor window it would switch to whenever filling out an input field. This seems like a better solution to this problem to me (and was almost a necessity on that device since it didn’t have a proper keyboard).

Re: Stop Password Masking

#53

Post by blhack »

One of the most annoying offenders of this is the windows wireless configuration utility.

It refuses to let you see the WEP key that you are typing, but insists that you type it twice.

If it were something like "what is your favorite flavor of popsicls" and not "type this random 58 character sting of hex", then that might be acceptable, but it isn't. Really, who is going to be standing over your shoulder and memorize that?

/drives me insane

//iwconfig ath0 essid "blueberry struedel" key $foo ftw

Re: Stop Password Masking

#54

Post by ErrantX »

fcr wrote: post #39
mgrouchy wrote: post #31

Earlier quoted context omitted.

While this is true. In the general case, if your application is required to be secure, its not a choice. Don't get me wrong, usability is very important, but if your application has to be secure(and not having someone look at your password over your shoulder is a requirement), then how can you choose usability over security?

not having someone look at your password over your shoulder is a requirement What I say is that sometimes this is not a requirement even if the website offers a login feature. I guess that for my online mail client I would prefer to have a masked password field. Now for my account at an online rss reader I actually don't care that much because there is nothing to protect (at least in my opinion) and no value for some…

Dont forget many people use the same password all over the place (silly I know - but it is something every site should assume and plan for!).

So in essence if you leave a password field open then your potentially exposing the "global" password of your user to anyone walking past. That seems an even bigger consideration than just exposing the pass to your site. Your taking away any security the user expects when typing a password in :)

Re: Stop Password Masking

#55

Post by jsonscripter »

fcr wrote: post #23
dinkumthinkum wrote: post #19

Earlier quoted context omitted.

Even if you could make it easy to find such an option, you'd just be giving the users the loaded gun to shoot themselves with.

Well that's actually their responsibility... However they would appreciate the feature if they can't manage to make their password work (e.g. caps lock, different keyboard layout, etc.)

I was once typing in my password on a box I forgot I had converted to Dvorak. I was almost panicking because I was so sure I was entering the password correctly.

Re: Stop Password Masking

#56

Post by tokenadult »

Edinburger wrote: post #6
fb wrote: post #2

This guy must have been joking. The fact that HE always types his passwords alone in his office does not mean that any sane person would like a possibility that anyone ever has a chance to see his password. Apparently, some people are not always alone...

Yes, good luck to anyone in (a) an open-plan office or (b) an office with security cameras.

"Of course, a truly skilled criminal can simply look at the keyboard and note which keys are being pressed. So, password masking doesn't even protect fully against snoopers.

"More importantly, there's usually nobody looking over your shoulder when you log in to a website."

Re: Stop Password Masking

#57

Post by khandekars »

tezza wrote: post #45
khandekars wrote: post #11

Disagree. Even bullets shouldn't be displayed while the user types the password. Why should a security camera in an office know that the user's password length is ten, twelve or twenty nine characters?

Security cameras can just record the keys that you type the password in. If you cover your hand, the problem space is still small enough to guess just based on where you are covering and how long for. Only systems that do not use passwords are viable if you are being closely scrutinized. e.g. entering only selected characters from your passphrase.

Thanks. OT: How do we protect from such snooping? I thought that recording the keys was harder for the cameras since the keyboard would be masked by user's height or a partially closed tray. E.g. in a cyber cafe, the keyboard normally is below the tabletop in tray. This is also true of many companies in India, where they use desktops.

Re: Stop Password Masking

#58

Post by Hexstream »

cubix wrote: post #25

He is sure right about the reset button though. I can't be the only one who has entered a dozen or more fields only to lose it all with an inadvertent reset rather than submit. Also, how about the iPhone compromise? It displays the last character you typed for only an instant.

"I can't be the only one who has entered a dozen or more fields only to lose it all with an inadvertent reset rather than submit."

The solution is obvious to me. If javascript is enabled, allow the user to undo a reset.

If javascript is disabled, don't show a reset button or make it harder to click accidentally somehow (make it smaller or a link or more out of the way).

Re: Stop Password Masking

#59

Post by CWuestefeld »

mgrouchy wrote: post #15

Unfortunately usability doesn't necessarily coincide with security. If you have to choose between the two, security always wins.

The programmer thinks that security trumps usability. Unfortunately, he's not the one who decides how the security facilities will be used.

Consider systems that require long passwords, and even go as far as to scan them against a dictionary, ensuring that the p/w must be a jumble. Users will always subvert such a hard-to-use system by writing down the password, completely undermining the whole thing.

My netbook doesn't have hard CAPS and NUMLOCK lights, I need to look at the display's status bar to see it. When I log on, the status bar isn't shown. I can't tell if my keyboard is in numeric mode, so I can't tell if I'm typing my password. This frequently becomes very frustrating -- and this isn't hypothetical, it happens to me all the time.

Post reply on HN