×

Welcome to the Slashdot Beta site -- learn more here. Use the link in the footer or click here to return to the Classic version of Slashdot.

Thank you!

Before you choose to head back to the Classic look of the site, we'd appreciate it if you share your thoughts on the Beta; your feedback is what drives our ongoing development.

Beta is different and we value you taking the time to try it out. Please take a look at the changes we've made in Beta and  learn more about it. Thanks for reading, and for making the site better!

Nielsen Recommends Not Masking Passwords

timothy posted more than 4 years ago | from the *****-****-**-******** dept.

GUI 849

Mark writes "Usability expert and columnist Jakob Nielsen wants to abolish password masking: 'Usability suffers when users type in passwords and the only feedback they get is a row of bullets. Typically, masking passwords doesn't even increase security, but it does cost you business due to login failures.' I've never been impressed by the argument that 'I can't think why we need this (standard) security measure, so let's drop it.' It usually indicates a lack of imagination of the speaker. But in this case, does usability outweigh security?"

cancel ×
This is a preview of your comment

No Comment Title Entered

Anonymous Coward 1 minute ago

No Comment Entered

849 comments

Making my point with humor (4, Funny)

suso (153703) | more than 4 years ago | (#28470817)

Usability? What the hell is he talking about? The user doesn't see the dots, only other people see those. The user should see their own password when they type it. Maybe he should check his glasses because those characters must be so blurry to him that they look like dots.

Re:Making my point with humor (0)

Anonymous Coward | more than 4 years ago | (#28471073)

Silly Jakob, asTrix are for kids.

hunter2 (5, Funny)

beaviz (314065) | more than 4 years ago | (#28470827)

Nielsen is finally getting even for that old prank we pulled on him back in the day ;)

http://bash.org/?244321 [bash.org]

Re:hunter2 (5, Funny)

El_Muerte_TDS (592157) | more than 4 years ago | (#28471135)

Hmm... I always thought the forums I frequent had some censor for bad words, but I guess it's a password filter. That's neat.

I wonder if /. also has a feature like that, let me try it. Pen1s

Re:hunter2 (5, Funny)

suso (153703) | more than 4 years ago | (#28471169)

Hmm... I always thought the forums I frequent had some censor for bad words, but I guess it's a password filter. That's neat.

I wonder if /. also has a feature like that, let me try it. *****

Hey that worked, try some of your other passwords.

hunter2 (4, Interesting)

eldavojohn (898314) | more than 4 years ago | (#28470839)

Usability expert and columnist Jakob Nielsen

Well, I'm glad they found such an unbiased and informed person to make such a statement about security versus usability. And for a second there I was afraid he was just doing this for attention.

Mr. Nielsen, could you send us screen shots of a working example? Perhaps show us how it looks like when you log into the administrative console now with your password entered in and then a screenshot of the way you think it would be more usable. I'll review them and let you know in a most interesting way [bash.org] what I think.

Perhaps you should read up on our friend Kevin Mitnick [wikipedia.org] and NASA "Hacker" Gary McKinnon [slashdot.org] both of whom are no strangers to the over-the-shoulder-attack. Really, I'm no security expert or pen tester but I'm going to speculate that these 'soft hacks' are some of the most dangerous vulnerabilities left. Your suggestion just makes them all the more easier. Me personally would like to see the standard bumped up to the level of the input box not even being masked ... no input is recorded in anyway on the screen. Now that's a usability nightmare when you can't even backspace to correct your errors. I don't think I've seen this since my days in a computer lab at college but I think sacrificing a few login attempts worth of time is worth the security.

Typically, masking passwords doesn't even increase security ...

[citation desperately needed]

I think back to the few times when I've entered my password accidentally into the username box because the tab key I hit didn't register or the site didn't support it and I just felt nervous and dirty and needed to change my password. Just knowing that there were photons and radiation [slashdot.org] everywhere in my cube belying my password to anyone who cared to capture them ... I mean it's bad enough that the sound waves of my keystrokes are floating around telling people my password [slashdot.org]. Sorry to go all tinfoil hat on you there.

Re:hunter2 (3, Interesting)

digitalgiblet (530309) | more than 4 years ago | (#28471103)

Seriously, if you only evaluate software based on usability, then it is BAD to even require a password.

Requiring a password INSTANTLY makes software harder to use. Not requiring a password makes the user's life much easier and simpler.

Now if you care about more than just usability, then you may want to reconsider dropping or masking passwords.

Re:hunter2 (1)

rootofevil (188401) | more than 4 years ago | (#28471109)

Typically, masking passwords doesn't even increase security ...

[citation desperately needed]

maybe hes referring to the case where people write their now very complex and long passwords (by requirement of the system) down so that they can be remembered properly.

this a wild, pull it out of my ass guess. so no snarky retorts. not that anyone does that on the internet.

Re:hunter2 (1)

ls671 (1122017) | more than 4 years ago | (#28471141)

Keyboard sniffers (especially software ones) are a lot easier to install than cameras by remote attackers, I guess the guy has got a point !

Re:hunter2 (1)

ucblockhead (63650) | more than 4 years ago | (#28471233)

There are many situations where "over the shoulder" attacks are simply not possible. For one, it assumes that the person in question is entering the password in a public (or semipublic) place. For people logging in to sites in their own homes, this sort of attack is exceedingly unlikely. Now given that password entry failures generally lead to insecure password recovery methods like "secret questions", the current state of things is not good.

The trouble is that most applications are designed for public computer labs not private homes.

Two words (5, Insightful)

RollingThunder (88952) | more than 4 years ago | (#28470865)

Shoulder surfing.

Seriously, is this guy is supposed to be an expert?

This is like having a fuel efficiency expert tell you to turn the motor off on your car, stick it in neutral, and push it, since it'll get infinite MPG. Passwords are supposed to be secret. Usernames aren't as critical.

Re:Two words (1)

2starr (202647) | more than 4 years ago | (#28470951)

I *often* type passwords in with people looking over my shoulder at work. I see their point and maybe it could be a system-wide setting... but it's valuable. One of the biggest problems with doing this is that people use the same passwords so often. So, if one is compromised, many will be... and some may be important.

Re:Two words (1)

ByOhTek (1181381) | more than 4 years ago | (#28471083)

So, you mean, if people find out my password is "Nobody Can Guess My UberPassw0rd" for slashdot, they might figure out it's my password for other things as well?

Re:Two words (1)

geekoid (135745) | more than 4 years ago | (#28471231)

Yeah, they can't watch you type.

Seriously, what do you do where people are looking over your shoulder while you are typing your password?

Some place should have it but most office work it's pointless.

Re:Two words (1)

Mr. Slippery (47854) | more than 4 years ago | (#28470999)

Shoulder surfing.

Might I suggest you RTFA?

Most websites (and many other applications) mask passwords as users type them, and thereby theoretically prevent miscreants from looking over users' shoulders. Of course, a truly skilled criminal can simply look at the keyboard and note which keys are being pressed. So, password masking doesn't even protect fully against snoopers.

More importantly, there's usually nobody looking over your shoulder when you log in to a website. It's just you, sitting all alone in your office, suffering reduced usability to protect against a non-issue.

Re:Two words (1)

Darkness404 (1287218) | more than 4 years ago | (#28471165)

Of course, a truly skilled criminal can simply look at the keyboard and note which keys are being pressed. So, password masking doesn't even protect fully against snoopers.

Anyone with a password they type often can usually type it fast enough that unless the criminal was really, really, really observant (or smart enough to use a keylogger) the password would still be safe. And really, the criminal isn't your biggest enemy. Lets say you log in to Facebook on your friends computer, if he can see the password he can use it for all sorts of harm that really isn't that criminal, that could really ruin business/personal lives. The idea that we are always totally isolated is false, how often do you go about your work only to notice someone behind you? Some of us don't have the luxury of our own offices but either share one with one or two other people or have a cubicle.

Re:Two words (5, Insightful)

amicusNYCL (1538833) | more than 4 years ago | (#28471193)

Oh, c'mon.

So, password masking doesn't even protect fully against snoopers.

No, it doesn't protect fully, but it does protect from everyone who can't see the keyboard when you type. In other words, it protects against every shoulder-surfing scenario except when the person is looking directly at the keyboard when you type. And even then, if you're typing fast enough or the keys are close enough together you won't be able to guess the password by watching the keyboard. Hell, I'm sitting right in front of the keyboard and I still can't look through my hands to see which keys my fingertips are actually pressing. So, password masking does protect from shoulder-surfing. It might not protect against people looking directly at your keyboard, but that might be because it's designed specifically to protect against people looking at the goddamn monitor.

More importantly, there's usually nobody looking over your shoulder when you log in to a website. It's just you, sitting all alone in your office, suffering reduced usability to protect against a non-issue.

OK, so this is a great usability solution for websites that only get accessed by people sitting alone in their offices without the possibility of a co-worker standing there as they log in. For all other sites that people might access in an internet cafe, or at the airport, or in a coffee shop, or wherever else, I guess it doesn't apply at all.

Re:Two words (5, Funny)

mwvdlee (775178) | more than 4 years ago | (#28471225)

Most websites (and many other applications) mask passwords as users type them, and thereby theoretically prevent miscreants from looking over users' shoulders. Of course, a truly skilled criminal can simply look at the keyboard and note which keys are being pressed. So, password masking doesn't even protect fully against snoopers.

Might as well just put all my expensive electronics on the front lawn, since a truly skilled burglar can simply pick the lock and steal it anyway. So, keeping your valuables behind closed doors doesn't even protect fully against theft. It sure as hell makes it more difficult for casual thieves though, which is probably nearly all of them.

More importantly, there's usually nobody looking over your shoulder when you log in to a website. It's just you, sitting all alone in your office, suffering reduced usability to protect against a non-issue.

Not all of us have those nice cushy jobs Mr. Nielsen has, where we have our very own office. Roughly 99.9993% of office workers have colleagues. I guess Mr. Nielsen is just a tad detached from reality here.

Re:Two words (0)

Anonymous Coward | more than 4 years ago | (#28471259)

Tried doing this before? Much harder to not only see what someone is typing but then remembering it is harder too because it's not yet displayed in text

Re:Two words (5, Insightful)

tomhudson (43916) | more than 4 years ago | (#28471013)

I'd rather have to retype the occasional password than have it visible to anyone shoulder surfing.

Think about your bank card, your PIN, etc.

FTFA:

It's therefore worth offering them a checkbox to have their passwords masked; for high-risk applications, such as bank accounts, you might even check this box by default. In cases where there's a tension between security and usability, sometimes security should win.

Retarded doesn't begin to cover this. Offering a default to turn OFF password masking for bank accounts? I'm sure the banks will just LOVE this one. We have enough problems with identity theft already.

Re:Two words (1)

JustNiz (692889) | more than 4 years ago | (#28471037)

>> Usernames aren't as critical.

Actually not true. If you don't know either a username or password its essentially impossible number of combinations to try to log in, however given one (it doesnt matter which), it becomes viable to use various approaches to get the other.

Re:Two words (1)

ByOhTek (1181381) | more than 4 years ago | (#28471053)

It's more like having a comfort specialist (yes, they don't exist, you can figure out what such a person would be from the name) tell you to roll down your windows for cooling when going on the freeway (you are moving faster! more cooling) but using AC on the side streets (not like the windows will cool you much). He then adds that the fuel economy of the car won't be impacted much, so why not?

The thing is, this guy is a usability expert, not a security expert. He only has a clue for about half of what he is talking about, and doesn't seem interested in the rest.

Re:Two words (2, Insightful)

dkleinsc (563838) | more than 4 years ago | (#28471133)

expert(n): Someone who will charge you a large amount of money to state the obvious (possibly to someone else who needs to be convinced of something).

The real geniuses of the world don't go around calling themselves "experts", they just do nifty things and solve interesting and difficult problems.

Another two words (3, Insightful)

El Gigante de Justic (994299) | more than 4 years ago | (#28471167)

Saved Passwords.

I typically have my web browser save my passwords for things I consider lower risk, but if masking is removed and the browser automatically loads the password into the form, then it's available to anyone. Considering that many users use the same or similar passwords for almost every application, and having it unmasked on one site could give up your info on any number of other sites.

Four words (1)

Carnildo (712617) | more than 4 years ago | (#28471181)

Shoulder surfing.

Only person in room.

Seriously, upwards of 99% of the time I type in a password, I'm the only person in the room and the door is closed. Does displaying bullets (or worse, nothing) really improve security? If I can see the password as I type it, I can write an epic passpoem that's almost impossible to guess, because I can see the typos I make. If I can't, I'm limited to about 30 lowercase alphanumerics, or ten random characters: beyond that, tyops are too common.

Re:Two words (1)

geekoid (135745) | more than 4 years ago | (#28471191)

Shoulder surfing isn't really much of a problem in the work place.
When was the last time someone stood close enough to read your password and you didn't know they where there?

Shoulder surfing is just an excuse to implement a half brained feel good 'security' measure.

Ya don't say? (0)

qoncept (599709) | more than 4 years ago | (#28470869)

but it does cost you business due to login failures.

I've never been impressed by the argument that 'I can't think why we need this (standard) security measure, so let's drop it.' It usually indicates a lack of imagination of the speaker.

Wake up, buddy.

Um, here's a thought. (4, Interesting)

greenguy (162630) | more than 4 years ago | (#28470875)

Howzabout we make it optional, so people can decide for themselves?

Re:Um, here's a thought. (1)

Exawatt (1463719) | more than 4 years ago | (#28470969)

I agree. There are times I want it to be masked (at a public location), and times I do not wish it to be masked (at home). I vote it's defaulted to show bullets, and has an option to remove them.

Re:Um, here's a thought. (5, Insightful)

Yetihehe (971185) | more than 4 years ago | (#28470975)

It's possible, the only problem is with browsers. Almost all of them remember what you put in normal text fields. Next time on page - just press down arrow and voila!

Add smarts to browsers, not pages! (2, Insightful)

jonaskoelker (922170) | more than 4 years ago | (#28471215)

[browsers] remember what you put in normal text fields.

Well, here's an easy fix: browsers add a checkbox-ish context menu item to password fields saying "don't hide text behind dots". Pages don't have to do anything, and browsers don't need to change caching behavior.

On the other hand, we only post passwords over HTTPS which browsers don't cache anyways. Right, slashdot? Right? Harumph :(

No, please do not do not make it a preference (1, Interesting)

Anonymous Coward | more than 4 years ago | (#28471075)

37signals on Avoiding Preferences [37signals.com]

Preferences are a way to avoid making tough decisions... It may seem like you're doing [your customers] a favor but you're just making busy work for them (and it's likely they're busy enough).

I hate preferences. Just let me sign in and move on.

Re:No, please do not do not make it a preference (1)

The End Of Days (1243248) | more than 4 years ago | (#28471161)

If only every problem in life could be reduced to a specific-functionality wiki, 37signals might count for something.

Re:No, please do not do not make it a preference (1)

Estanislao Martnez (203477) | more than 4 years ago | (#28471219)

I don't think the proposal is to make it a difference. I think the proposal is to have password entry widgets have a little checkbox to control whether the text in them is masked, and have it default to unmasked. Whether you need masking or not is a case-by-case decision.

That's a brilliant idea! (2, Informative)

Estanislao Martnez (203477) | more than 4 years ago | (#28471113)

And, surprise, that's exactly what TFA recommends! Quote:

Yes, users are sometimes truly at risk of having bystanders spy on their passwords, such as when they're using an Internet cafe. It's therefore worth offering them a checkbox to have their passwords masked; for high-risk applications, such as bank accounts, you might even check this box by default. In cases where there's a tension between security and usability, sometimes security should win.

Re:Um, here's a thought. (2, Informative)

clone53421 (1310749) | more than 4 years ago | (#28471131)

javascript:for(var a=document.getElementsByTagName("input"),i=0;i<a.length;i++)if(a[i].type=="password")void(a[i].type="text");

Bookmark it if you want.

For bonus points, set a timeout that restores all the fields you changed to their original password types after a few seconds.

Re:Um, here's a thought. (0)

Anonymous Coward | more than 4 years ago | (#28471149)

Because 99% of people that would enable this option in the workplace would have sensitive information on their machines that the cleaner shouldn't be able to see.

How about a compromise? (5, Insightful)

Verteiron (224042) | more than 4 years ago | (#28470893)

Personally, I rather like the way many cellphones handle this: show the letter that was typed for a moment and THEN mask it. This allows you to spot typos and correct them without having to blank the field and start over.

Ever typed a long WPA key into an iPhone? (5, Insightful)

Anonymous Coward | more than 4 years ago | (#28471137)

The cellphone method works great and has never bothered me until I had to enter a 63-character WPA key into an iPhone. This is something you can't do from memory, so you're moving your eyes back and forth between a plaintext copy, and trying to remember just where you left off. Agony.

Basically, in a few situations like this, it would be really handy to turn off masking one-time-only.

No More Encryption! (1)

annihilizard (605481) | more than 4 years ago | (#28470895)

You know, he makes alot of sense. we should also drop encrypting passwords on the system as well. It's ridiculous that people should have reset a password in order to recover access! it should all be stored in plain text somewhere.

It's time! (3, Interesting)

kurtmckee (870398) | more than 4 years ago | (#28470897)

I agree, it's time to switch to the Unix password entry scheme. No feedback is good feedback!

Re:It's time! (1)

ffohwx (1434637) | more than 4 years ago | (#28470961)

I concur. I love it. People looking over your shoulder can't even count the bullets and find out how long you password is!

Re:It's time! (0)

Anonymous Coward | more than 4 years ago | (#28471229)

Except for those of us with an IBM Model M keyboard. The entire office can hear my keystrokes and tell how long my password is :(

Not to fanboi all over the place... (1, Interesting)

Bemopolis (698691) | more than 4 years ago | (#28470909)

...but the iPhone has a good compromise: as you type in your iTunes password, the letter you just typed in gets bulleted. This is especially important for those of us who have trouble with typos on a regular keyboard, never mind the phone's.

Re:Not to fanboi all over the place... (5, Informative)

IANAAC (692242) | more than 4 years ago | (#28471023)

Around long before the iPhone, but it was a nice try to attribute that to the iPhone.

Re:Not to fanboi all over the place... (2, Insightful)

Duradin (1261418) | more than 4 years ago | (#28471263)

I think you confused an example of something with the attribution of something.

He said "the iPhone has this feature".

He didn't say "the iPhone innovated this feature".

Do you feel better now after your minute of Apple-hate?

As they say... (1)

Franklin Brauner (1034220) | more than 4 years ago | (#28470911)

Better to have one and not need it, than to need one and not have it.

Re:As they say... (0, Troll)

suso (153703) | more than 4 years ago | (#28471003)

You know who else says that? Governments with nuclear weapons.

Re:As they say... (5, Funny)

nebaz (453974) | more than 4 years ago | (#28471201)

I say "good morning" to people in the morning. You know who else said that? Mussolini. Therefore...

the iPhone does it right... (-1, Redundant)

nweaver (113078) | more than 4 years ago | (#28470925)

The iPhone password input doesn't mask the most recent inputed character in a password dialog, but masks all the older ones and masks the input one after 2-3 seconds.

Thus you get the masking mostly, but the feedback to prevent errors (which are considerably more annoying on the iPhone/iPod touch keyboard arrangement when typing blind).

Re:the iPhone does it right... (0)

Anonymous Coward | more than 4 years ago | (#28471123)

Having the characters flash like the iPhone totally defeats the purpose of masking the characters in my opinion.
Showing dots instead of characters is a way for people to notice when they accidentally hit two keys instead of one while not giving up that password which is supposed to be secured even if someone is beside you watching over your shoulder.
Then again, the iPhone being a hand-held, it is less likely that someone is indeed watching over your shoulder, but if that's the case, you'll be giving him up your password as though it had been written out in the open.

legal reasons (0)

Anonymous Coward | more than 4 years ago | (#28470931)

My guess is that everyone's already figured out what Nielson has suggested, but they don't want to change it for legal reasons. You don't want an expert witness testifying in court that a password may have been stolen through eavesdropping.

Otherwise, yeah... first two attempts should be masked, subsequent attempts cleartext by default with a checkoff option to mask. ATM and debit card readers, always masked, no option.

He's an idiot (0)

Anonymous Coward | more than 4 years ago | (#28470937)

If you're not sure you're entering your password correctly, look around, ensure nobody's looking over your shoulder, and then type your password into the user id field. If it's correct, back space and enter your user id, and then the password.

But they do recommend willy smacking (0)

Anonymous Coward | more than 4 years ago | (#28470945)

Imagine your Willy being smacked until it bleeds.

J.delanoy

Makes sense (1)

kgwilliam (998911) | more than 4 years ago | (#28470953)

Using a masked password to protect security is useless 99% of the time you are typing in a password. The only time it is useful is if you are in a semi-public environment (classroom, coffee shop, etc). I suppose it might also be useful if you log into highly secure sites and are worried about someone across the street with binoculaurs looking through your window, but then you have other security issues to worry about :)

Perhaps a checkbox, off by default, next to password boxes that will toggle the mask.

Re:Makes sense (0)

Anonymous Coward | more than 4 years ago | (#28471045)

The world is your basement, eh?

Some of us actually live significant portions of our lives in "semi-public environments".

Only when registering (0)

basementman (1475159) | more than 4 years ago | (#28470971)

IMHO passwords should be fully visible when a user is either changing their password, or registering a new account. This means we no longer need to confirm passwords twice when registering. And it still cuts down on the number of times when a password is visible and vulnerable to other people.

Re:Only when registering (2, Insightful)

i'm lost (1247580) | more than 4 years ago | (#28471145)

This means we no longer need to confirm passwords twice when registering.

Yeah, just like we don't have to confirm email addresses right now.

Ever looked at your password? (2, Insightful)

fandingo (1541045) | more than 4 years ago | (#28470977)

Does anyone ever think it's weird to actually look at your password? I never write them down, and I remember them mostly by the location of the keys on the keyboard, not by the actual text. To me, it's quite unnatural to look at a password.

Re:Ever looked at your password? (1)

clone53421 (1310749) | more than 4 years ago | (#28471253)

I don't know about passwords, but I definitely use this approach to help remember phone numbers.

After "typing" the number repeatedly on an imaginary numpad (the keyboard variety, not the phone variety... I'm much more used to having the 1 at the bottom-left than the upper-left), I find it's a lot easier to recall it later – although I might have to reverse the process to figure out what numbers I'm actually pressing when I want to remember it.

Of course, I also do weird things like memorise the alphabet backwards (zyxwvutsrqponmlkjihgfedcba) or pi to several dozen decimal places (3.141592653589793238462643383), so maybe I'm just strange...

Easy solution (4, Insightful)

wjousts (1529427) | more than 4 years ago | (#28470979)

Change your password to **********

Re:Easy solution (1)

gad_zuki! (70830) | more than 4 years ago | (#28471159)

When I was 10 or 11 years old and my parents got me a 1200 baud modem for my Apple//e I managed to dial up a BBS and was asked for the first time to make a username and password. I dont remember the username, but I do remember seeing *'s come out as I typed, got confused, so I just made my password ******. Ta da! Problem solved.

Re:Easy solution (0)

Anonymous Coward | more than 4 years ago | (#28471197)

Why should I change my password to hunter2?

Solutions exist... (1)

Manip (656104) | more than 4 years ago | (#28470981)

The sad truth is that better methods for handling password boxes have existed for years but haven't been picked up for whatever reason. The truth is that Microsoft really does deserve a fair bit of blame considering the OS generates most password boxes.

A nice password box that I've used would display the last character you typed for a very short period of time and then convert it into a dot. So as you type you can read it back to yourself but without really making it easy for anyone around you to see your completed password. Worked great.

Biometric scanners (1)

TheKidYo (1412903) | more than 4 years ago | (#28470985)

I look forward to a future where all computers have biometric equipment and project-natal-esque face recognition SO I NEVER NEED TO REMEMBER ANOTHER PASSWORD AGAIN!

One word for Nielsen: Projector (5, Insightful)

tcsh(1) (683224) | more than 4 years ago | (#28470993)

Ever logged in to a computer connected to an LCD projector?

Re:One word for Nielsen: Projector (1)

Slipped_Disk (532132) | more than 4 years ago | (#28471243)

Ooh - EXCELLENT point!
This actually makes my "do it like the iPhone" idea untenable since the entire room would see your password one letter at a time...

Re:One word for Nielsen: Projector (1)

geekoid (135745) | more than 4 years ago | (#28471261)

Most people don't.
This is about people who are using there password on a projector, or even in a public terminal.

Security vs usability (1)

rwalker429 (1452827) | more than 4 years ago | (#28471005)

Isn't security always a balancing act against usability? The inconvenience of not being able to read a password as you type seems pretty minimal when weighed against the damage that could be caused when some mildly educated user I pissed off swipes my password by taking a look over my shoulder one day and decides to get even. And I'm pretty sure you could just as easily lose a client whose accounts were so easily compromised...as well as rack up some pretty epic fines in civil litigation if the circumstances are right. Don't we have more important security issues to be debating these days?

Not in a world with support analysts (1)

CambodiaSam (1153015) | more than 4 years ago | (#28471017)

Our company has support analysts that will shadow a user's machine for troubleshooting. The masking is a necessity for us. We want plausible deniability if someone claims a hacked account.

Cash Machines! (1)

oolon (43347) | more than 4 years ago | (#28471021)

I wonder why they don't do this with cash machines, it sure would help with skimming easier, rather than having to look at those fingers! Idiots! Now we can crash a co-workers computer and get got watch the password being typed it.

Um. (1)

Darkness404 (1287218) | more than 4 years ago | (#28471035)

typically, masking passwords doesn't even increase security, but it does cost you business due to login failures

Lets see here.... In a school setting (college or otherwise) lets say a computer in the lab breaks. You are a simi-competent CS student and the admin goes over to fix it. He types in the root password, if it was visible you just got root into any computer at the university and could do whatever you wanted. However if it was masked, it wouldn't be that easy.

As for business, what person can't type in 6-10 characters (average length of a password) and can't get it right in 1-5 tries? Really, the only excuse for that is if you aren't using a keyboard and even then things like the iPhone assist you in showing the plain text for a time then blanking it. I see no reason not to mask passwords and thousands of arguments for it.

Yeah, you really do (1)

nixdroid (1482893) | more than 4 years ago | (#28471039)

In crowded areas like a call center (and some NOCs) it is necessary to obfuscate passwords. At home or a private office, maybe not. Perhaps letting the admin or user decide is practical. Although the suggestion would no doubt start a major, and hostile, conflagration.

Tools (0, Troll)

Carrot007 (37198) | more than 4 years ago | (#28471047)

If people are too stupid to hit the right keys without more feedback than the knowledge they have hit a key then they probably should be taken out back and shot. (or are too intoxicated to be making a purchase and glad or the service)

Masking passwords doesn't do much (1, Redundant)

delirium of disorder (701392) | more than 4 years ago | (#28471057)

If someone can shouldersurf, 99% of the time they have physical access and all security is null. If they can see your ***ed password on the screen, than they can see your fingers type they characters of your password on the keyboard (again with 1% exceptions like keyboard covers and remote displays). If a malicious person can see your screen, than they are probably close enough that that can tap your cables, install hardware keyloggers, sniff your EMF, cold boot your RAM and grep it, do audio analysis of your typing and decipher your keystrokes, and etc.

***ing your passwords protects against a very small hole....the situation where someone is allowed to see your screen but is searched to make sure they have no monitoring equipment, has the keyboard kept out of site, and isn't allowed to touch anything.

Well its about doggone time (1)

Gat1024 (199252) | more than 4 years ago | (#28471089)

Really, what good are the dots? It doesn't prevent someone from looking over your shoulder. A villain can just look at your keyboard while you type. Maybe its of some use on a public terminal, but I check my six before I type in a security password anyway.

The obscured pass(word|phrase|key) has been the most aggravating while trying to type in a strong WiFi password on an IPhone (pre 2.something-or-nother update). Try it. The aggravation is pure ecstasy. Luckily Apple has wised up and shows you the last character you've typed at least.

And how about disabling paste from a security box. You can't verify your passkey when you're troubleshooting. A determined villain can get to it anyway, especially if they have access to your machine. Don't even get me started on the 'super' secure entry boxes where you can't paste TO the security edit box.

Get rid of passwords.. (1)

askksa (1167121) | more than 4 years ago | (#28471091)

Why not get rid of the concept of passwords? Isn't public key-cryptography perfectly designed to do so?

Security (2, Insightful)

ucblockhead (63650) | more than 4 years ago | (#28471093)

One of the most irritating things is the way many websites, especially financial websites, are designed with no thought to the difference between use in a public setting and use in a private setting. For instance, I only ever use my banking website from one place, my den, which is physically secure, yet I have to suffer through all sorts of crap designed to make sure my account doesn't get compromised in a public setting. (The most annoying being automatic log outs for non-use.)

Masking passwords, logging off the user on non-use after ten minutes, and other such security methods do not actually decrease the chance of compromise significantly when the user has physical security. Websites should allow for this.

Indeed lack of imagination (5, Insightful)

guruevi (827432) | more than 4 years ago | (#28471099)

1) If I look outside my office window, I can see about 48 office windows (without standing up) and all of them have the lights on and it's dusk outside. Give me a dSLR and a decent set of long distance lenses and I'll prove you wrong.

2) How many times have you typed in your password while somebody was looking at your screen eg. to show somebody something on a protected website. This happens a lot to tech people as we have to authenticate to solve an issue while somebody is standing next to me waiting for me to fix it.

3) How many times have you given a presentation where your screen view (but not your keyboard input) goes worldwide (eg. teleconference) or over a set of wires that you know haven't been tampered with (conference room) - again, logging in to your webmail or so to find a copy of your presentation.

4) How difficult is it to create a script that takes screenshots - how difficult is it to create a script that captures keyboard entry as well. Answer: the first can be done in userspace (and in the hands of an experienced script kiddie would be unnoticed), the latter usually has to go as a request to a driver, kernel or other layer that requires admin rights. This is true for Windows, Mac and (depending on your GUI) Linux

Hidden department revealed! (2, Informative)

gcnaddict (841664) | more than 4 years ago | (#28471129)

*****-****-**-********
Don't_mask_my_password

(I used my stealthy password exposer to find that out.)

Utterly absurd! (1)

kheldan (1460303) | more than 4 years ago | (#28471163)

The average person, unless you put a gun to their head and MAKE them do differently, will choose a password that an 8-year-old can guess, and he wants to make it easier for unauthorized people to see whole or partial passwords? Rediculous. Not that it matters all that much, I guess, since the average person also treats network security like a joke, and lets co-workers have their password regardless of what policy is.

Shoulder Surffing and Screen Snapshot Capture (1)

Nom du Keyboard (633989) | more than 4 years ago | (#28471171)

He seems to believe that shoulder surfing and screen snapshot capture simply doesn't exist. I'm left to ask if the complainer is trying to solve his problem at the expense of everyone else.

Two more words for Nielsen: Security Cameras (5, Insightful)

hoosbane (643500) | more than 4 years ago | (#28471173)

Just because you don't think someone is watching over your shoulder, doesn't mean someone isn't watching over your shoulder.

Browsers can solve this (1)

basketcase (114777) | more than 4 years ago | (#28471175)

Since we are talking about web logins here there is a simple solution...

Most modern web browsers support remembering passwords and typing them in for you. If you are so unconcerned about security that you want your password to be displayed on the screen for anyone to see then you may as well just let your browser type it in for you and eliminate the typo problem completely.

Reason for masking matters (1)

Todd Knarr (15451) | more than 4 years ago | (#28471209)

Masking was intended to keep people from shoulder-surfing your password as you entered it. In the days of public computer rooms where you'd have a dozen people behind you who could see your screen, masking made a lot of sense. When you're already in private, though, and there's nobody behind you to see your screen, password masking doesn't make any sense anymore. However, if you think about it there's still lots of time when you're not in private. In your own home you don't need masking most times, but think about sitting at the local coffee shop. Or in the airport on a trip. Or in an open-plan office. All those times you may have someone behind you who can see your screen. Or who's got a camera with enough resolution he can enlarge the picture later to get the screen contents. Those times I'd prefer the passwords be masked so eavesdroppers can't see them.

Of course the two aren't mutually exclusive. HTML for instance defines fields that're protected/masked. Just use them and let the user control with a setting whether protected/masked fields should be masked or their contents displayed. Then the user can decide which to use, and they're the ones who'll have to bear the consequences if their password gets out so they've an incentive to make a reasonable choice.

Why not a compromise? (1, Insightful)

Slipped_Disk (532132) | more than 4 years ago | (#28471211)

What TFA is suggesting is probably one of the dumbest ideas I've heard since... EVER. That said, the dots are a usability issue -- I've got plenty of otherwise very smart users who screw up passwords constantly.

As a compromise measure I propose stealing something from Apple's playbook: The iPhone password entry interface. The last character typed is visible for 2-3 seconds, everything else is masked (and backspacing doesn't reveal characters, just makes the dots go away). The design doesn't suck, and the security compromise isn't as bad as "leave the password on-screen for everyone to see" like the article is suggesting.

idiotic idea (0, Redundant)

poetmatt (793785) | more than 4 years ago | (#28471251)

Here's something people don't realize:

Remember all those laws about "in plain sight" and all that how law enforcement can steal your info just because something isn't locked away etc?

Well guess what happens to passwords like this. Spy through a window at home, etc.

Load More Comments
Slashdot Account

Need an Account?

Forgot your password?

Don't worry, we never post anything without your permission.

Submission Text Formatting Tips

We support a small subset of HTML, namely these tags:

  • b
  • i
  • p
  • br
  • a
  • ol
  • ul
  • li
  • dl
  • dt
  • dd
  • em
  • strong
  • tt
  • blockquote
  • div
  • quote
  • ecode

"ecode" can be used for code snippets, for example:

<ecode>    while(1) { do_something(); } </ecode>
Sign up for Slashdot Newsletters
Create a Slashdot Account

Loading...