Slashdot Mirror
Nielsen Recommends Not Masking Passwords
Mark writes "Usability expert and columnist Jakob Nielsen wants to abolish password masking: 'Usability suffers when users type in passwords and the only feedback they get is a row of bullets. Typically, masking passwords doesn't even increase security, but it does cost you business due to login failures.' I've never been impressed by the argument that 'I can't think why we need this (standard) security measure, so let's drop it.' It usually indicates a lack of imagination of the speaker. But in this case, does usability outweigh security?"
Usability? What the hell is he talking about? The user doesn't see the dots, only other people see those. The user should see their own password when they type it. Maybe he should check his glasses because those characters must be so blurry to him that they look like dots.
Nielsen is finally getting even for that old prank we pulled on him back in the day ;)
http://bash.org/?244321
Hey, that's the same as the combination on my luggage!
I say "good morning" to people in the morning. You know who else said that? Mussolini. Therefore...
Rhymes that keep their secrets will unfold behind the clouds.There upon the rainbow is the answer to a neverending story
Most websites (and many other applications) mask passwords as users type them, and thereby theoretically prevent miscreants from looking over users' shoulders. Of course, a truly skilled criminal can simply look at the keyboard and note which keys are being pressed. So, password masking doesn't even protect fully against snoopers.
Might as well just put all my expensive electronics on the front lawn, since a truly skilled burglar can simply pick the lock and steal it anyway. So, keeping your valuables behind closed doors doesn't even protect fully against theft. It sure as hell makes it more difficult for casual thieves though, which is probably nearly all of them.
More importantly, there's usually nobody looking over your shoulder when you log in to a website. It's just you, sitting all alone in your office, suffering reduced usability to protect against a non-issue.
Not all of us have those nice cushy jobs Mr. Nielsen has, where we have our very own office. Roughly 99.9993% of office workers have colleagues. I guess Mr. Nielsen is just a tad detached from reality here.
Slashdot social media options: AIM, ICQ, Yahoo, Jabber and Mobile Text. Why no MySpace?
i can type my password without even looking
watch, i'll enter my bank account password without looking
fluffybunnies
see? i didn't even need to...
oh crap...
unsubmit
where's the damn unsubmit!
intellectual property law is philosophically incoherent. it is your moral duty to ignore it or sabotage it
I like the way Lotus Notes used to do it. As you typed you'd get a random heiroglyphic. As long as your glyph matched what you remembered, you knew that you'd typed the password correctly. Nobody could guess by watching the monitor even how long your password was.
When our name is on the back of your car, we're behind you all the way!
I can't read what word you wrote. It is filtered or something.
Clovis
^ Clovis, look! It's that guy you are!
I would hope that most eight-year-olds haven't been exposed to the kind of language I use in my passwords.
The CB App. What's your 20?
Why you have to type our WiFi password twice:
The first time sends the password to my botnet.
The second time actually logs you in.
-- Terry
I've seen it.
There was this guy wanting to do a presentation in front of around 50 people on a ubuntu laptop and he typed his password in the "User" textedit of login window. Everyone erupted with laughter because his password was "jebenica_l01" (something like fuckery lol in english). I don't blame him too much, that login window has serious flaw with showing only one textedit at the time and both of them in the same place which can lead to situation like this when people are under pressure. Needless to say, the guy was red in the face and stuttering horribly the whole time.
Trolls are like broken clocks. They show the truth two times a day. The rest of the day they talk nonsense.
Lets say my boss is hanging around, waiting for something important to him to get done. My password is a very rude word...
http://michaelsmith.id.au
Instead of bullets, the password could appear in one of those CAPTCHA fonts; anybody shoulder-surfing would have to stare at it for 10 minutes to decipher it.