Nielsen Recommends Not Masking Passwords

Mark writes "Usability expert and columnist Jakob Nielsen wants to abolish password masking: 'Usability suffers when users type in passwords and the only feedback they get is a row of bullets. Typically, masking passwords doesn't even increase security, but it does cost you business due to login failures.' I've never been impressed by the argument that 'I can't think why we need this (standard) security measure, so let's drop it.' It usually indicates a lack of imagination of the speaker. But in this case, does usability outweigh security?"

Comments

Making my point with humor

[suso]

Usability? What the hell is he talking about? The user doesn't see the dots, only other people see those. The user should see their own password when they type it. Maybe he should check his glasses because those characters must be so blurry to him that they look like dots.

Re:Making my point with humor

[Profane MuthaFucka]

That comment is 99.99999% funny. It's 0.00001% true in the case of an all asterix passwd.

Re:Making my point with humor

[religious freak]

Dots? Who the hell has dots? My unix login prompt cursor doesn't even move when I type the password in; I'd love to have some dots!

Re:Making my point with humor

[doti]

That's because knowing the number of characters in a password greatly eases the password guessing.

The masking is indeed a bad idea. Your unix login prompt does the right thing.

Re:Making my point with humor

[suso]

I've never even seen my password in plain text. I don't want to either. Ever.

That's good, only your hands should know your password.

Re:Making my point with humor

[transporter_ii]

I think passwords should spin, and any right characters you try should make that digit stop spinning, to let you know that character was right. That would put things more in line with the movies and make hacking a lot more fun.
.

Re:Making my point with humor

[NighthawkFoo]

What's even better is that the dialog doesn't indicate whether it has focus or not, so you end up typing your password into your IM window.

Re:Making my point with humor

[mellon]

Dude, I want *your* computer. Or your glasses. Or something.

You have illustrated the point nicely. However, the fact is that there is a problem here. The average naive user thinks that when they type a password in, and it's hidden, that means that it's secure. They equate the dots with end-to-end security. And of course there is no end-to-end security. So actually the dots are a usability problem - just not the one Mr. Nielsen suggests.

Fundamentally, the problem is that there is no security in the way passwords are done on the net. By this I mean that even though we do have security protocols like SSL, and we do have mechanisms for signing certs, the current security model assumes that the user will discriminate between situations where there is security, and situations where there is not. And nearly every single user of web services is incapable of discriminating in that way. There are maybe one or two thousand people in the world who really understand the security model well enough and are anal enough to actually validate the security of what they are doing when they enter passwords into web forms.

So essentially Mr. Nielsen is right - you might as well not bother with the dots. Because they just give you a false sense of security.

Re:Making my point with humor

[gdshaw]

Actually, the comment is (perhaps unintentionally) insightful. According to the current (25th June 2009) draft of the HTML 5 spec:

"The user agent should obscure the value so that people other than the user cannot see it."

Re:Making my point with humor

[lindseyp]

What's even better than that is when the password input window *does* have focus, and the IM window steals it just as you start to type it in.

focus-stealing windows should be banned.

hunter2

[beaviz]

Nielsen is finally getting even for that old prank we pulled on him back in the day ;)

http://bash.org/?244321

Re:hunter2

[El_Muerte_TDS]

Hmm... I always thought the forums I frequent had some censor for bad words, but I guess it's a password filter. That's neat.

I wonder if /. also has a feature like that, let me try it. Pen1s

Re:hunter2

[suso]

Hmm... I always thought the forums I frequent had some censor for bad words, but I guess it's a password filter. That's neat.

I wonder if /. also has a feature like that, let me try it. *****

Hey that worked, try some of your other passwords.

Re:hunter2

[El_Muerte_TDS]

Neat, let me try a longer one. Erecti0n

Re:hunter2

[Darkness404]

About the only thing that requires a complex password for most people is work. At work, most everyone is too scared of being fired to really mess with people's accounts. Really the only point of passwords there is to keep out network attacks or so people can work at home. If someone can't remember 6-8 characters with a number thrown in there for good measure, perhaps they should not be on the internet.

Re:hunter2

[Useful Wheat]

System Error:

Password too short.

Re:hunter2

[CopaceticOpus]

Neat, let me try a longer one. ********

Cool, that worked also. Do you have anything harder?

Re:hunter2

[vidarh]

If Stephen Hawking says something about physics, do you require a citation from him? Nielson is recognized as one of the leading experts in his field.

No, but if Stephen Hawking made a claim that flew in the face of established conventions in - say - psychology, I would expect a citation. Nielsen is a usability expert, not a security expert, and GP questioned his claim about the security aspect.

Re:hunter2

[adamstew]

If Stephen Hawking says something about physics, do you require a citation from him? Nielson is recognized as one of the leading experts in his field.

Yes! I would! I would want to see the research that lead him to his conclusion in physics. Or, more specifically, I would want another physicist to look at his research and give his validation to say that it's sound.

Re:hunter2

[ImaLamer]

Harder than erecti0n?

Re:hunter2

[ColdWetDog]

Good point. It is far too difficult for the guy with the telescope and photomultiplier tube to aim the thing at your keyboard, capture your hand motions and play them back at low speed. The dots are totally secure.

That's why you should always use a Dvorak keyboard. Without the letters on the caps. Just to be sure.

Re:hunter2

[cliveholloway]

dild0?

Re:hunter2

[macslut]

I'm so disappointed as I was hoping to find an answer here. I've been wondering about the whole entering the password twice for Microsoft on a wireless network for years now. I have a Mac, and every time a Windows user asks me to repeat the password, I ask them why...they tell me they need to enter it twice, so I ask *why*. Nobody has ever offered me an answer. That would drive me friggin nuts as a Windows user...not just doing it, but knowing there was no valid reason as to why. Now email addresses on online forms are a different story, they're just trying to make sure you did it correctly by making sure the addresses match. For the wireless network login this makes no sense because if you did get it wrong, then no loss, just that's when you'd have to enter it the second time. I think someone really screwed up at Microsoft on this, but why was it left this way after numerous patches? Apple does allow you to hide or reveal your password for the wireless network, which is funny because this option is a bit more of a risk than just letting you see your password while entering it. By allowing you to reveal the password after it's been entered, they're allowing anyone to walk up to a Mac that's connected and see the wireless password when the user is away.

hunter2

[eldavojohn]

Usability expert and columnist Jakob Nielsen

Well, I'm glad they found such an unbiased and informed person to make such a statement about security versus usability. And for a second there I was afraid he was just doing this for attention.

Mr. Nielsen, could you send us screen shots of a working example? Perhaps show us how it looks like when you log into the administrative console now with your password entered in and then a screenshot of the way you think it would be more usable. I'll review them and let you know in a most interesting way what I think.

Perhaps you should read up on our friend Kevin Mitnick and NASA "Hacker" Gary McKinnon both of whom are no strangers to the over-the-shoulder-attack. Really, I'm no security expert or pen tester but I'm going to speculate that these 'soft hacks' are some of the most dangerous vulnerabilities left. Your suggestion just makes them all the more easier. Me personally would like to see the standard bumped up to the level of the input box not even being masked ... no input is recorded in anyway on the screen. Now that's a usability nightmare when you can't even backspace to correct your errors. I don't think I've seen this since my days in a computer lab at college but I think sacrificing a few login attempts worth of time is worth the security.

Typically, masking passwords doesn't even increase security ...

[citation desperately needed]

I think back to the few times when I've entered my password accidentally into the username box because the tab key I hit didn't register or the site didn't support it and I just felt nervous and dirty and needed to change my password. Just knowing that there were photons and radiation everywhere in my cube belying my password to anyone who cared to capture them ... I mean it's bad enough that the sound waves of my keystrokes are floating around telling people my password. Sorry to go all tinfoil hat on you there.

Two words

[RollingThunder]

Shoulder surfing.

Seriously, is this guy is supposed to be an expert?

This is like having a fuel efficiency expert tell you to turn the motor off on your car, stick it in neutral, and push it, since it'll get infinite MPG. Passwords are supposed to be secret. Usernames aren't as critical.

Re:Two words

[tomhudson]

I'd rather have to retype the occasional password than have it visible to anyone shoulder surfing.

Think about your bank card, your PIN, etc.

FTFA:

It's therefore worth offering them a checkbox to have their passwords masked; for high-risk applications, such as bank accounts, you might even check this box by default. In cases where there's a tension between security and usability, sometimes security should win.

Retarded doesn't begin to cover this. Offering a default to turn OFF password masking for bank accounts? I'm sure the banks will just LOVE this one. We have enough problems with identity theft already.

Re:Two words

[amicusNYCL]

Oh, c'mon.

So, password masking doesn't even protect fully against snoopers.

No, it doesn't protect fully, but it does protect from everyone who can't see the keyboard when you type. In other words, it protects against every shoulder-surfing scenario except when the person is looking directly at the keyboard when you type. And even then, if you're typing fast enough or the keys are close enough together you won't be able to guess the password by watching the keyboard. Hell, I'm sitting right in front of the keyboard and I still can't look through my hands to see which keys my fingertips are actually pressing. So, password masking does protect from shoulder-surfing. It might not protect against people looking directly at your keyboard, but that might be because it's designed specifically to protect against people looking at the goddamn monitor.

More importantly, there's usually nobody looking over your shoulder when you log in to a website. It's just you, sitting all alone in your office, suffering reduced usability to protect against a non-issue.

OK, so this is a great usability solution for websites that only get accessed by people sitting alone in their offices without the possibility of a co-worker standing there as they log in. For all other sites that people might access in an internet cafe, or at the airport, or in a coffee shop, or wherever else, I guess it doesn't apply at all.

Re:Two words

[mwvdlee]

Most websites (and many other applications) mask passwords as users type them, and thereby theoretically prevent miscreants from looking over users' shoulders. Of course, a truly skilled criminal can simply look at the keyboard and note which keys are being pressed. So, password masking doesn't even protect fully against snoopers.

Might as well just put all my expensive electronics on the front lawn, since a truly skilled burglar can simply pick the lock and steal it anyway. So, keeping your valuables behind closed doors doesn't even protect fully against theft. It sure as hell makes it more difficult for casual thieves though, which is probably nearly all of them.

More importantly, there's usually nobody looking over your shoulder when you log in to a website. It's just you, sitting all alone in your office, suffering reduced usability to protect against a non-issue.

Not all of us have those nice cushy jobs Mr. Nielsen has, where we have our very own office. Roughly 99.9993% of office workers have colleagues. I guess Mr. Nielsen is just a tad detached from reality here.

Re:Two words

[rtfa-troll]

Sure, being the RTFA troll, I read the article. But that still doesn't convince me. The keyboard press is a brief instant on a device which is easy to place more or less out of line of sight. A visible password on a screen is present for a long time and there are a number of interesting ways to capture this. Whilst keyboards are not perfect I think that some protection is worthwhile. One thing is for sure. Nobody is going to remember to turn this on when they are in public and your password only needs to be captured once.

One thing that might be a possible compromise is the system the mail client on my Nokia phone uses. The most recent character entered in the password is displayed for a short time. I can see each individual character, but the entire password is not exposed. I worry on the subway, but since it's a personal device it's easier to make this difficult to see.

Re:Two words

[radtea]

Retarded doesn't begin to cover this.

The best thing about the article, typical of an unfortunately large amount of usability literature, is the complete absence of empirical data. He simply asserts, for example, "users will not be confused by this" without offering a shred of empirical evidence for the claim. I'm not a typical user, but I'd sure as hell be confused if plaintext started to appear in the UI where a decade or two of experience has taught me to expect a line of bullets. I sure as hell wouldn't want to be on a helpdesk for a system that has just made this change.

Usability is an important area of software design, but it is still in its infancy, and the lack of usability experts chiming in to call this guy a blithering idiot is depressing. All claims about usability of any feature should be considered nonsense until someone comes to you with empirical data from real users that tell you what they find usable. Otherwise you're arguing mythological hypotheticals--how many users can dance on a pinhead.

Re:Two words

[hey!]

Well, that's the crux isn't it?

To a usability expert, expectations are your friends. You trust them. You believe in them.

To a security expert, expectations are your enemies. You distrust them. You try to figure out what they're hiding from you.

Of course, everyone agrees that what is expected and what happens *should* be the same, but I think here the securities guys have the more legitimate concern. Mr. Nielson doesn't even considers the possibility that his expectations might be violated. He assumes they are benign as long as they are "usually" right.

What does "usually" mean? *You the user* may "usually" type the password where you can't be watched (although how Nielson knows this applies to me I have no idea). But the usual case for the *criminal* is the situation where *some* user is being vulnerable. He doesn't care about the legions of users who are not exposed to a problem. He cares about the sufficient number of users to his purpose that are. He *seeks* what we consider negligible and makes his home there.

Suppose I design a web site with ten thousand users a day. Suppose a certain situation comes up only 1/10 of one percent. of the time for any given user on any given day. To a usability expert that's negligible. To a security expert, that means I'll be guaranteeing ten exposures to vulnerabilities per day. That's great for attackers. They don't care that *most* users aren't exposed to this problem *most* of the time. They only care that *some* users will be exposed to this problem nearly *all* of the time.

All engineering is about balancing costs and benefits. But you've got to know the probabilities, and to do that right you've got to determine the right population to calculate them with. Once we've established that the "unusual" user case is the "usual" attacker case, we have to recalculate our cost estimates. Where an attack is extremely unlikely, Mr. Nielson is correct in saying that the increment of security that masking gives is small. We're talking about very, very small probabilities, so the only increment we might rationally care about is dropping the probability to zero. Since some criminals can read keystrokes from a keyboard (although by no means many), we don't achieve that. Therefore masking is useless.

However, from the perspective of the attacker and site owner, a situation where some users are exposed to this kind of attack is quite common. It literally happens all the time for a large site. Therefore if masking repulsed, say, 50% of attacks (being very, very conservative), it's still worth doing if you want to keep your site secure, or care about possible violations of user privacy.

Um, here's a thought.

[greenguy]

Howzabout we make it optional, so people can decide for themselves?

Re:Um, here's a thought.

[Yetihehe]

It's possible, the only problem is with browsers. Almost all of them remember what you put in normal text fields. Next time on page - just press down arrow and voila!

How about a compromise?

[Verteiron]

Personally, I rather like the way many cellphones handle this: show the letter that was typed for a moment and THEN mask it. This allows you to spot typos and correct them without having to blank the field and start over.

Easy solution

[wjousts]

Change your password to **********

One word for Nielsen: Projector

[tcsh(1)]

Ever logged in to a computer connected to an LCD projector?

Re:Not to fanboi all over the place...

[IANAAC]

Around long before the iPhone, but it was a nice try to attribute that to the iPhone.

Indeed lack of imagination

[guruevi]

1) If I look outside my office window, I can see about 48 office windows (without standing up) and all of them have the lights on and it's dusk outside. Give me a dSLR and a decent set of long distance lenses and I'll prove you wrong.

2) How many times have you typed in your password while somebody was looking at your screen eg. to show somebody something on a protected website. This happens a lot to tech people as we have to authenticate to solve an issue while somebody is standing next to me waiting for me to fix it.

3) How many times have you given a presentation where your screen view (but not your keyboard input) goes worldwide (eg. teleconference) or over a set of wires that you know haven't been tampered with (conference room) - again, logging in to your webmail or so to find a copy of your presentation.

4) How difficult is it to create a script that takes screenshots - how difficult is it to create a script that captures keyboard entry as well. Answer: the first can be done in userspace (and in the hands of an experienced script kiddie would be unnoticed), the latter usually has to go as a request to a driver, kernel or other layer that requires admin rights. This is true for Windows, Mac and (depending on your GUI) Linux

Ever typed a long WPA key into an iPhone?

[Anonymous Coward]

The cellphone method works great and has never bothered me until I had to enter a 63-character WPA key into an iPhone. This is something you can't do from memory, so you're moving your eyes back and forth between a plaintext copy, and trying to remember just where you left off. Agony.

Basically, in a few situations like this, it would be really handy to turn off masking one-time-only.

Two more words for Nielsen: Security Cameras

[hoosbane]

Just because you don't think someone is watching over your shoulder, doesn't mean someone isn't watching over your shoulder.

Re:As they say...

[nebaz]

I say "good morning" to people in the morning. You know who else said that? Mussolini. Therefore...

its not a problem for me

[circletimessquare]

i can type my password without even looking

watch, i'll enter my bank account password without looking

fluffybunnies

see? i didn't even need to...

oh crap...

unsubmit

where's the damn unsubmit!

You could always let the user choose

[marcus]

In a secure environment, with no one looking over my shoulder why not leave the chars in the clear?

Give 'em a checkbox: "Echo password []" which defaults to "unchecked" of course.

Re:You could always let the user choose

[Rei]

For what it's worth, I've had a password compromised before by someone looking over my shoulder at what *keys* I typed. I'd rather not make it even easier for people by letting them just look at the screen, thanks. As you note, you never know whether your environment is secure. In my case, back in TAMS, I had a "friend" who was chatting with me as an excuse to stand close enough / above me to see the keyboard; he then set up a porn site on my university account as a prank.

Strangely enough, the last I heard from him, he was becoming a Mormon missionary...

Re:You could always let the user choose

[speculatrix]

S60 has been doing this before the iPhone/iPodTouch was even a rumour within apple.

Re:You could always let the user choose

[Narcocide]

Your sig should be "Don't shoulder surf my password bro!" This is a situation where compromise is not appropriate. The unix login prompt has proper behavior. The story post is correct; obscured characters are dumb. The assumption that therefore they should be shown in plain text is incorrect. Your password should not be shown at all as you are typing it or at any time in any representation.

Re:You could always let the user choose

[noidentity]

Instead of bullets, the password could appear in one of those CAPTCHA fonts; anybody shoulder-surfing would have to stare at it for 10 minutes to decipher it.

Microsoft wep key

[blueskies]

The microsoft wireless access passwords are done like that because they are complete idiots. Why do you have to type it in twice?? If it works on the first try, why use the second field at all?

Re:Microsoft wep key

[iPhr0stByt3]

If you mis-type the password to a wireless network, the AP won't even tell you it's wrong. That is because the AP will hopefully act as if it was correct in order to significantly slow down brute force password attempts. Windows will try to get a DHCP address and eventually come up with "limited or no connectivity". Therefore, using a double-check might save a few minutes if you can correct your typo immediately. I'm not saying that I prefer this. I'd personally rather have just one box and type it carefully, but that is a valid and good reason for this behavior.

Why you have to type our WiFi password twice:

[tlambert]

Why you have to type our WiFi password twice:

The first time sends the password to my botnet.

The second time actually logs you in.

-- Terry