Slashdot Mirror
Nielsen Recommends Not Masking Passwords
Mark writes "Usability expert and columnist Jakob Nielsen wants to abolish password masking: 'Usability suffers when users type in passwords and the only feedback they get is a row of bullets. Typically, masking passwords doesn't even increase security, but it does cost you business due to login failures.' I've never been impressed by the argument that 'I can't think why we need this (standard) security measure, so let's drop it.' It usually indicates a lack of imagination of the speaker. But in this case, does usability outweigh security?"
Usability? What the hell is he talking about? The user doesn't see the dots, only other people see those. The user should see their own password when they type it. Maybe he should check his glasses because those characters must be so blurry to him that they look like dots.
Nielsen is finally getting even for that old prank we pulled on him back in the day ;)
http://bash.org/?244321
Usability expert and columnist Jakob Nielsen
Well, I'm glad they found such an unbiased and informed person to make such a statement about security versus usability. And for a second there I was afraid he was just doing this for attention.
... no input is recorded in anyway on the screen. Now that's a usability nightmare when you can't even backspace to correct your errors. I don't think I've seen this since my days in a computer lab at college but I think sacrificing a few login attempts worth of time is worth the security.
Mr. Nielsen, could you send us screen shots of a working example? Perhaps show us how it looks like when you log into the administrative console now with your password entered in and then a screenshot of the way you think it would be more usable. I'll review them and let you know in a most interesting way what I think.
Perhaps you should read up on our friend Kevin Mitnick and NASA "Hacker" Gary McKinnon both of whom are no strangers to the over-the-shoulder-attack. Really, I'm no security expert or pen tester but I'm going to speculate that these 'soft hacks' are some of the most dangerous vulnerabilities left. Your suggestion just makes them all the more easier. Me personally would like to see the standard bumped up to the level of the input box not even being masked
Typically, masking passwords doesn't even increase security ...
[citation desperately needed]
... I mean it's bad enough that the sound waves of my keystrokes are floating around telling people my password. Sorry to go all tinfoil hat on you there.
I think back to the few times when I've entered my password accidentally into the username box because the tab key I hit didn't register or the site didn't support it and I just felt nervous and dirty and needed to change my password. Just knowing that there were photons and radiation everywhere in my cube belying my password to anyone who cared to capture them
My work here is dung.
Shoulder surfing.
Seriously, is this guy is supposed to be an expert?
This is like having a fuel efficiency expert tell you to turn the motor off on your car, stick it in neutral, and push it, since it'll get infinite MPG. Passwords are supposed to be secret. Usernames aren't as critical.
Howzabout we make it optional, so people can decide for themselves?
What if I do the same thing, and I do get different results?
Personally, I rather like the way many cellphones handle this: show the letter that was typed for a moment and THEN mask it. This allows you to spot typos and correct them without having to blank the field and start over.
End of lesson. You may press the button.
I agree, it's time to switch to the Unix password entry scheme. No feedback is good feedback!
Does anyone ever think it's weird to actually look at your password? I never write them down, and I remember them mostly by the location of the keys on the keyboard, not by the actual text. To me, it's quite unnatural to look at a password.
Change your password to **********
Ever logged in to a computer connected to an LCD projector?
Around long before the iPhone, but it was a nice try to attribute that to the iPhone.
Hey, that's the same as the combination on my luggage!
One of the most irritating things is the way many websites, especially financial websites, are designed with no thought to the difference between use in a public setting and use in a private setting. For instance, I only ever use my banking website from one place, my den, which is physically secure, yet I have to suffer through all sorts of crap designed to make sure my account doesn't get compromised in a public setting. (The most annoying being automatic log outs for non-use.)
Masking passwords, logging off the user on non-use after ten minutes, and other such security methods do not actually decrease the chance of compromise significantly when the user has physical security. Websites should allow for this.
The cake is a pie
1) If I look outside my office window, I can see about 48 office windows (without standing up) and all of them have the lights on and it's dusk outside. Give me a dSLR and a decent set of long distance lenses and I'll prove you wrong.
2) How many times have you typed in your password while somebody was looking at your screen eg. to show somebody something on a protected website. This happens a lot to tech people as we have to authenticate to solve an issue while somebody is standing next to me waiting for me to fix it.
3) How many times have you given a presentation where your screen view (but not your keyboard input) goes worldwide (eg. teleconference) or over a set of wires that you know haven't been tampered with (conference room) - again, logging in to your webmail or so to find a copy of your presentation.
4) How difficult is it to create a script that takes screenshots - how difficult is it to create a script that captures keyboard entry as well. Answer: the first can be done in userspace (and in the hands of an experienced script kiddie would be unnoticed), the latter usually has to go as a request to a driver, kernel or other layer that requires admin rights. This is true for Windows, Mac and (depending on your GUI) Linux
Custom electronics and digital signage for your business: www.evcircuits.com
And, surprise, that's exactly what TFA recommends! Quote:
Are you adequate?
*****-****-**-********
Don't_mask_my_password
(I used my stealthy password exposer to find that out.)
Viable Slashdot alternatives: https://pipedot.org/ and http://soylentnews.org/
The cellphone method works great and has never bothered me until I had to enter a 63-character WPA key into an iPhone. This is something you can't do from memory, so you're moving your eyes back and forth between a plaintext copy, and trying to remember just where you left off. Agony.
Basically, in a few situations like this, it would be really handy to turn off masking one-time-only.
This means we no longer need to confirm passwords twice when registering.
Yeah, just like we don't have to confirm email addresses right now.
Saved Passwords.
I typically have my web browser save my passwords for things I consider lower risk, but if masking is removed and the browser automatically loads the password into the form, then it's available to anyone. Considering that many users use the same or similar passwords for almost every application, and having it unmasked on one site could give up your info on any number of other sites.
Just because you don't think someone is watching over your shoulder, doesn't mean someone isn't watching over your shoulder.
I say "good morning" to people in the morning. You know who else said that? Mussolini. Therefore...
Rhymes that keep their secrets will unfold behind the clouds.There upon the rainbow is the answer to a neverending story
[browsers] remember what you put in normal text fields.
Well, here's an easy fix: browsers add a checkbox-ish context menu item to password fields saying "don't hide text behind dots". Pages don't have to do anything, and browsers don't need to change caching behavior.
On the other hand, we only post passwords over HTTPS which browsers don't cache anyways. Right, slashdot? Right? Harumph :(
I think you confused an example of something with the attribution of something.
He said "the iPhone has this feature".
He didn't say "the iPhone innovated this feature".
Do you feel better now after your minute of Apple-hate?
In many places in OS X, there is a "display password" checkbox under password entry fields. So, by default the password is hidden, but if needed, you can click the checkbox and it will be displayed. best of both world I think.
I'd rather be sailing...
i can type my password without even looking
watch, i'll enter my bank account password without looking
fluffybunnies
see? i didn't even need to...
oh crap...
unsubmit
where's the damn unsubmit!
intellectual property law is philosophically incoherent. it is your moral duty to ignore it or sabotage it
On my old website, I had for a while password fields with no bullets. I had assumed, that given the low-importance nature of the site and all, no one would really care, and it did make it easier.
A few weeks after opening, I had found out that a few people had not created accounts, because they had the strange idea that not having bullets somehow made the site less secure. That somehow, *I* would be able to see their password, more than if there were bullets.
Needless to say, I changed over my password fields to bulleted, because I didn't want to lose any possible members to such a stupid problem. I still think that plain text is better, but it has become mandatory security theater. Much like an SSL cert makes even the most questionable site legitimate, lacking bulleted passwords makes people think you're being sneaky somehow. It is sad, but it's reality.
Great Intellect...
I like the way Lotus Notes used to do it. As you typed you'd get a random heiroglyphic. As long as your glyph matched what you remembered, you knew that you'd typed the password correctly. Nobody could guess by watching the monitor even how long your password was.
When our name is on the back of your car, we're behind you all the way!
than they can see your fingers type they characters of your password on the keyboard
Have you ever tried that? Unless you practice it a good bit you are quite unlikely to succeed, you also have to have a good stare at the keyboard which could be easily noticed by the user. Having the password clearly readable on the screen is a whole different matter. People are trained to recognize words quite literally in the blink of an eye. So any non-trivial password is very easy to spot when its written to the screen, even from a distance when you are not actually trying to read it you could spot it just by accident, as you can't stop your brain from recognizing words.
The argument with the keyboard logger really isn't a good one. Sure, obscuring the password won't stop all attacks, but it will stop a lot of attacks and raise the bar for attack much higher, as you have to actually plan the attack and not just look at the screen at the right moment by accident.
That said, an option on the entry-box to de-obscure the password would be welcome, since some are just a chore to type without visual confirmation (long WLAN keys and such).
I would hope that most eight-year-olds haven't been exposed to the kind of language I use in my passwords.
The CB App. What's your 20?
Good for you. Have you ever considered that you aren't in the majority? If not, I'd suggest that you start considering that question EVERY SINGLE TIME you start thinking to yourself something that starts with "But I..."
In a secure environment, with no one looking over my shoulder why not leave the chars in the clear?
Give 'em a checkbox: "Echo password []" which defaults to "unchecked" of course.
Good judgement comes from experience, and experience comes from bad judgement.
- W. Wriston, former Citibank CEO
The microsoft wireless access passwords are done like that because they are complete idiots. Why do you have to type it in twice?? If it works on the first try, why use the second field at all?
Why you have to type our WiFi password twice:
The first time sends the password to my botnet.
The second time actually logs you in.
-- Terry
Don't direct your ire toward information security just because your particular sysadmin happens to be an idiot.
I first saw it on Nokias S60 3rd edition, some 4 years ago; never had the occasion to try it on earlier S60s. It really is an extraordinary usability improvement, especially for keypads.
Note however, the Nokias don't enable the feature when you enter a numeric password (e.g. the PIN), so I don't think they meant it as a usability feature in the sense Nielsen wants, but simply to overcome the frustration of entering masked letters on a numeric keypad.
And it's quite obvious Apple didn't come up with the idea: they didn't patent it. Call it cynicism or my minute of Apple hate, but i prefer to call it pragmatism.
That FTP IS stupid. They should switch to SFTP and require digital certificates to connect, so they can authenticate connections without compromising login credentials.
We are the 198 proof..
The developer can usually rely on the users being in an environment that's not secure enough for password to be displayed in the clear, though secure enough to assume nobody is video recording keypresses.
With unmasked passwords, you'd have to change important passwords whenever someone walks past you just as you're typing them in. This scenario can be so common - office, starbucks, etc.
Nielsen talks about usability, so how usable is that?
In contrast if someone was _standing_ close by and you suspect him of trying to see what keys you were pressing, you can usually turn to him and say "Hey, do you mind?" or take appropriate countermeasures.
Most people aren't allowed to kill random strangers who just happened to see unmasked passwords. So if someone just walks past, it's password change time. Whoopee for usability.
So I recommend not relying on Nielsen for advice on security at all. And if this is typical of the level of thinking he does, I recommend that people not waste time reading his stuff.
After all if users are in such secure environments as he claims, why bother having passwords at all? Why not just let the website recognize their cookie and log them in right away?