I noticed that heysan didn't mask the password on their login page when using my nintendo dsi, incompetence or usability?
Stop Password Masking
61–70 of 83 posts
Re: Stop Password Masking
#62This is totally ridiculous. So whenever my colleagues or students are working with me on something and I have login to my email or whatever system I need to get to, it's not bad enough that I have to feel uncomfortable that they can see my keyboard while I type my password but they can just look at it on the screen. I guess this is what happens when you actually let "usability experts" design your systems. As for thi…
Yes, hidden by default would be better, even when the password is only protecting photos of my cat.
Re: Stop Password Masking
#63Sadly, my employer is going the opposite direction and planning to implement "strong user names" and mask both fields. This is in response to users with access to sensitive information leaving passwords written down near their workstations.
Clearly the answer is another password.
Re: Stop Password Masking
#64Earlier quoted context omitted.
Would you know?
And would you know if they just recorded the keys your fingers pressed? I think Jakob is really onto something here.
They could record the sound of the keypresses too. They may be impossible to discriminate subjectively, but they all have a distinct signature...
Re: Stop Password Masking
#65This is very unconventional advise. But this is Jacob Nielsen talking on usability. What he says is generally backed by very extensive testing and way more usability experience than any of us on news.YC have. You might not agree to unmask all passwords but why not this > It's therefore worth offering them a checkbox to have their passwords masked; for high-risk applications, such as bank accounts, you might even chec…
>So please think hard on this, before you dismiss this as stupid or untenable. I have. This is stupid and untenable. Problem one: Right now if I encountered a login form that didn't mask the password I would probably attribute this to incompetence, not usability. I don't think I'm the only one. Problem two: Right now all login forms work the same. The top field is the username and under that is the password field. Th…
Wicked. That is a much better considered solution to the problem.
That I think is the problem with the original message - the problem IS sort of there but the solution is just too readical for it :P
Re: Stop Password Masking
#66I think it would be good if browsers came with an option to mask or don't mask passwords. But I don't know if it would work, since the users who would find and change that option would be the heavy users, that have almost no trouble with passwords. If only that option could be easily showed and asked for simple users: a little icon within password boxes showing if it's masked or not, and a hotkey / click on the icon…
It's fairly easy to do actually, if you're willing to accept the cheat I've used in the past.
You can read the input value with Javascript, so if you add an 'unmask password' button, then that button should effectively replace the input type=password with an input type=password and populate it with the values previously stored in the password element.
There are a number of ways to do this, but switching out elements was the easiest for me -- of course, browsers have come a long way since that implementation. YMMV.
Re: Stop Password Masking
#67Summary: We have no data about this problem, nor our proposed solution.
"In most cases, however, users will appreciate getting clear-text feedback as they enter passwords."
If Nielsen had a mockup or something that we could all clearly see was a huge improvement, then sure, let's do it. A UI change this drastic should have an order of magnitude gain to it. Otherwise, move on to bigger fish.
Re: Stop Password Masking
#68Earlier quoted context omitted.
Of course, but it's highly unlikely you'd accidentally expose that page to someone. I was thinking more along the lines of letting your friend use your computer to check gmail, and whoops, there's your password already in the box.
Of course, but if I let my friend use my computer to check gmail, he or she could go to Firefox -> Preferences -> Security -> Saved Passwords and see all of my passwords anyway. By letting somebody use my computer, I'm implicitly trusting them to not misuse anything they might find.
The problem is it's no longer avoidable. A friend is unlikely to want to snoop on your saved password list, but can not avoid it when your password is already in the box, and they have to delete it to type their own in.
Anyway, the simple fix is to not show saved passwords in plain text.
Re: Stop Password Masking
#69Earlier quoted context omitted.
> For instance, every time I give a presentation I usually have to login to a secure site. To be fair, he did suggest that password masking was toggled by a checkbox that was ON by default.
It's just too easy to screw that up and despite the argument proferred there is no real benefit. If typing on mobile devices is hard it doesn't seem what we need to do is post our credit card numbers online.
I used to work as phone support for a webapp targeted at Real Estate Agents. 60% of our web + phone support requests were related to passwords. A third of those requests were errors due to misspellings.
An option to reveal the text of the password field would have a drastic effect on these support requests. It would lower calls and call times on these issues. Even if this 15-minute change only saved 30 minutes of support time a -year- this would be a net win.
You might not screw up passwords, but plenty of people do. I'm not suggesting to have it permanently visible, just the option to make it visible. This enables people with password issues to debug their own issues before resorting to a password reset or contacting support.
Re: Stop Password Masking
#70[deleted]