Slashdot Mirror
Nielsen Recommends Not Masking Passwords
Mark writes "Usability expert and columnist Jakob Nielsen wants to abolish password masking: 'Usability suffers when users type in passwords and the only feedback they get is a row of bullets. Typically, masking passwords doesn't even increase security, but it does cost you business due to login failures.' I've never been impressed by the argument that 'I can't think why we need this (standard) security measure, so let's drop it.' It usually indicates a lack of imagination of the speaker. But in this case, does usability outweigh security?"
Shoulder surfing.
Seriously, is this guy is supposed to be an expert?
This is like having a fuel efficiency expert tell you to turn the motor off on your car, stick it in neutral, and push it, since it'll get infinite MPG. Passwords are supposed to be secret. Usernames aren't as critical.
Personally, I rather like the way many cellphones handle this: show the letter that was typed for a moment and THEN mask it. This allows you to spot typos and correct them without having to blank the field and start over.
End of lesson. You may press the button.
It's possible, the only problem is with browsers. Almost all of them remember what you put in normal text fields. Next time on page - just press down arrow and voila!
Extreme Programming - Redundant Array of Inexpensive Developers
Does anyone ever think it's weird to actually look at your password? I never write them down, and I remember them mostly by the location of the keys on the keyboard, not by the actual text. To me, it's quite unnatural to look at a password.
Change your password to **********
Ever logged in to a computer connected to an LCD projector?
One of the most irritating things is the way many websites, especially financial websites, are designed with no thought to the difference between use in a public setting and use in a private setting. For instance, I only ever use my banking website from one place, my den, which is physically secure, yet I have to suffer through all sorts of crap designed to make sure my account doesn't get compromised in a public setting. (The most annoying being automatic log outs for non-use.)
Masking passwords, logging off the user on non-use after ten minutes, and other such security methods do not actually decrease the chance of compromise significantly when the user has physical security. Websites should allow for this.
The cake is a pie
1) If I look outside my office window, I can see about 48 office windows (without standing up) and all of them have the lights on and it's dusk outside. Give me a dSLR and a decent set of long distance lenses and I'll prove you wrong.
2) How many times have you typed in your password while somebody was looking at your screen eg. to show somebody something on a protected website. This happens a lot to tech people as we have to authenticate to solve an issue while somebody is standing next to me waiting for me to fix it.
3) How many times have you given a presentation where your screen view (but not your keyboard input) goes worldwide (eg. teleconference) or over a set of wires that you know haven't been tampered with (conference room) - again, logging in to your webmail or so to find a copy of your presentation.
4) How difficult is it to create a script that takes screenshots - how difficult is it to create a script that captures keyboard entry as well. Answer: the first can be done in userspace (and in the hands of an experienced script kiddie would be unnoticed), the latter usually has to go as a request to a driver, kernel or other layer that requires admin rights. This is true for Windows, Mac and (depending on your GUI) Linux
Custom electronics and digital signage for your business: www.evcircuits.com
The cellphone method works great and has never bothered me until I had to enter a 63-character WPA key into an iPhone. This is something you can't do from memory, so you're moving your eyes back and forth between a plaintext copy, and trying to remember just where you left off. Agony.
Basically, in a few situations like this, it would be really handy to turn off masking one-time-only.
This means we no longer need to confirm passwords twice when registering.
Yeah, just like we don't have to confirm email addresses right now.
Saved Passwords.
I typically have my web browser save my passwords for things I consider lower risk, but if masking is removed and the browser automatically loads the password into the form, then it's available to anyone. Considering that many users use the same or similar passwords for almost every application, and having it unmasked on one site could give up your info on any number of other sites.
Just because you don't think someone is watching over your shoulder, doesn't mean someone isn't watching over your shoulder.
What TFA is suggesting is probably one of the dumbest ideas I've heard since... EVER. That said, the dots are a usability issue -- I've got plenty of otherwise very smart users who screw up passwords constantly.
As a compromise measure I propose stealing something from Apple's playbook: The iPhone password entry interface. The last character typed is visible for 2-3 seconds, everything else is masked (and backspacing doesn't reveal characters, just makes the dots go away). The design doesn't suck, and the security compromise isn't as bad as "leave the password on-screen for everyone to see" like the article is suggesting.
/~mikeg
[browsers] remember what you put in normal text fields.
Well, here's an easy fix: browsers add a checkbox-ish context menu item to password fields saying "don't hide text behind dots". Pages don't have to do anything, and browsers don't need to change caching behavior.
On the other hand, we only post passwords over HTTPS which browsers don't cache anyways. Right, slashdot? Right? Harumph :(
I think you confused an example of something with the attribution of something.
He said "the iPhone has this feature".
He didn't say "the iPhone innovated this feature".
Do you feel better now after your minute of Apple-hate?
About the only thing that requires a complex password for most people is work. At work, most everyone is too scared of being fired to really mess with people's accounts. Really the only point of passwords there is to keep out network attacks or so people can work at home. If someone can't remember 6-8 characters with a number thrown in there for good measure, perhaps they should not be on the internet.
Taxation is legalized theft, no more, no less.
About 999 times out of 1000, I'm sitting in an environment (either at home or in the office) where I really don't care if anyone sees my password. For that one time where I do care, maybe we can have a checkbox for making the password invisible while we type.
The problem with security is really that once you start down that path, nothing is ever enough - at least not to the security gestapo (motto: "our work ain't done until you can't do yours"). Stellar example: the FTP at work is configured to have a ~10s delay after logging in, "to stop the evil h4x0rz". It's driving me nuts, so I suggested accepting the first connection without any delay, and then introducing a delay for each following connection if it occurs within 10s. That way hardly anyone will be bothered by the delay, but the h4x0rz will still be unable to flood the server with their evil password-attempting ways. But nooo, that was completely unacceptable! Because it would be INSECURE! Only a long delay guarantees security!
That's because knowing the number of characters in a password greatly eases the password guessing.
The masking is indeed a bad idea. Your unix login prompt does the right thing.
factor 966971: 966971
No, but if Stephen Hawking made a claim that flew in the face of established conventions in - say - psychology, I would expect a citation. Nielsen is a usability expert, not a security expert, and GP questioned his claim about the security aspect.
You might want to RTFA before typing out such a long post. If you did, you'd notice a few things.
1) He's specifically advocating this for login forms on the web
2) He specifically says that security trumps usability in some instances
3) He gives a very clear example of a way to enable/disable this feature
With the proliferation of mobile devices with tiny, sometimes virtual, keyboards, typos are very common. When you can't even see that you've made a typo because it is obscured by dots, then you have no chance of correcting it.
Wouldn't it be nice if you could uncheck a little box that says "Obsure my password"? If you're paranoid, you could just check the box before entering your password or leave it checked, depending on the default.
If Stephen Hawking says something about physics, do you require a citation from him? Nielson is recognized as one of the leading experts in his field.
Yes! I would! I would want to see the research that lead him to his conclusion in physics. Or, more specifically, I would want another physicist to look at his research and give his validation to say that it's sound.
If Stephen Hawking says something about physics, do you require a citation from him? Nielson is recognized as one of the leading experts in his field.
Not at all. But I wouldn't listen to his ideas on beating the Taliban in Afganistan.
In a secure environment, with no one looking over my shoulder why not leave the chars in the clear?
Give 'em a checkbox: "Echo password []" which defaults to "unchecked" of course.
Good judgement comes from experience, and experience comes from bad judgement.
- W. Wriston, former Citibank CEO
If Stephen Hawking says something about biology, do you require a citation from him? Nielson is recognized as one of the leading experts in his field.
Fixed.
Same thing with email addresses in online forms, why do I always have to type those in twice?
That's to reduce the chances you have a typo. Some even explain that.
I have no idea about the MS thing, it's probably because their WLAN taskbar applet sucks hard.
"When I first heard Daydream Nation it quite frankly scared the living shit out of me." -- Matthew Stearns
The microsoft wireless access passwords are done like that because they are complete idiots. Why do you have to type it in twice?? If it works on the first try, why use the second field at all?
Exactly. This Nielsen guy (I've never heard of him) is a complete moron. I read the summary and instantly thought of the over-the-shoulder attack. Here at work, I unfortunately am cursed with sitting in an "open seating" arrangement so it's pretty easy for people walking by to see what I'm doing on my computer. I don't trust everyone here with my passwords (otherwise, why would we even have them, since we need security badges to get in the door?), so I certainly don't want to see my password as I type it out. This completely defeats the security offered by a password.
If you're going to eliminate masking passwords, you might as well just go whole-hog and eliminate passwords altogether. How many are in favor of this? Hands?
Stephen Hawking would generally be expected to have something to back up his statements. People don't just come up with stuff out of thin air. They do research, experiment, formulate hypotheses and test them. That becomes the body of evidence on which Hawking would base his statements. What kind of evidence does Nielsen have to back his remarks? Polls? Focus groups?
Nielsen is essentially recommending that usability should trump security which is not necessarily the right answer. Now if he wants to recommend redesigning the authenication system, then I suggest that he collaborate with security experts and come up with a new authenication method then that is both user friendly, and secure.
I wonder if Nielsen's research considered instances where people forgot or entered the incorrect password. Cases in which, seeing the password in cleartext would not help. The easy answer is to look at the keyboard and see what you're pressing if you cant tell what you're pressing.
Dude, I want *your* computer. Or your glasses. Or something.
You have illustrated the point nicely. However, the fact is that there is a problem here. The average naive user thinks that when they type a password in, and it's hidden, that means that it's secure. They equate the dots with end-to-end security. And of course there is no end-to-end security. So actually the dots are a usability problem - just not the one Mr. Nielsen suggests.
Fundamentally, the problem is that there is no security in the way passwords are done on the net. By this I mean that even though we do have security protocols like SSL, and we do have mechanisms for signing certs, the current security model assumes that the user will discriminate between situations where there is security, and situations where there is not. And nearly every single user of web services is incapable of discriminating in that way. There are maybe one or two thousand people in the world who really understand the security model well enough and are anal enough to actually validate the security of what they are doing when they enter passwords into web forms.
So essentially Mr. Nielsen is right - you might as well not bother with the dots. Because they just give you a false sense of security.
Why did you bother explaining? Don't you see what a missed opportunity that was? If they don't log in, they can't fuck anything up!
What's even better than that is when the password input window *does* have focus, and the IM window steals it just as you start to type it in.
focus-stealing windows should be banned.
j'ai découvert une démonstration vraiment admirable (de ce théorème général) que cette si
He's not a security expert, but he IS a useability expert (even though I, a non-expert, often disagree with some of the things he writes).
He's the seventh grade English teacher of usability experts. Everything he says is useful the first time you hear it, but most of it is wrong.
focus-stealing windows should be banned.
And you can ban it. At least in XFCE, it's a standard option whether to give newly created windows focus or not (I leave it on because I find that behavior more intuitive than a window popping up and me having to move my mouse over it to start typing in it).
If you can't configure this basic option in your window manager, well, maybe it's time to change your WM?
Nielsen is not universally revered in HCI (/usability) circles, and we don't really have a Steven Hawking-like figure. He has done some pretty solid work in the past, but that only goes so far. A lot of UI/UX/ practitioners I know don't think highly of his recent stuff. So, [citation needed] is right, but [open mind needed] is as well.
I love my field, but it is really fluffy---most of what we accept as "true" is really just "things we generally accept or don't want to argue about any more". Like most pundits, Jakob is taking an extreme position to get practitioners to think about alternative methods of designing user interactions.
Or, programs should be able to lock focus when they are actively being typed into.
The developer can usually rely on the users being in an environment that's not secure enough for password to be displayed in the clear, though secure enough to assume nobody is video recording keypresses.
With unmasked passwords, you'd have to change important passwords whenever someone walks past you just as you're typing them in. This scenario can be so common - office, starbucks, etc.
Nielsen talks about usability, so how usable is that?
In contrast if someone was _standing_ close by and you suspect him of trying to see what keys you were pressing, you can usually turn to him and say "Hey, do you mind?" or take appropriate countermeasures.
Most people aren't allowed to kill random strangers who just happened to see unmasked passwords. So if someone just walks past, it's password change time. Whoopee for usability.
So I recommend not relying on Nielsen for advice on security at all. And if this is typical of the level of thinking he does, I recommend that people not waste time reading his stuff.
After all if users are in such secure environments as he claims, why bother having passwords at all? Why not just let the website recognize their cookie and log them in right away?