Nielsen Recommends Not Masking Passwords

Mark writes "Usability expert and columnist Jakob Nielsen wants to abolish password masking: 'Usability suffers when users type in passwords and the only feedback they get is a row of bullets. Typically, masking passwords doesn't even increase security, but it does cost you business due to login failures.' I've never been impressed by the argument that 'I can't think why we need this (standard) security measure, so let's drop it.' It usually indicates a lack of imagination of the speaker. But in this case, does usability outweigh security?"

Comments

hunter2

[beaviz]

Nielsen is finally getting even for that old prank we pulled on him back in the day ;)

http://bash.org/?244321

Re:hunter2

[El_Muerte_TDS]

Hmm... I always thought the forums I frequent had some censor for bad words, but I guess it's a password filter. That's neat.

I wonder if /. also has a feature like that, let me try it. Pen1s

Re:hunter2

[suso]

Hmm... I always thought the forums I frequent had some censor for bad words, but I guess it's a password filter. That's neat.

I wonder if /. also has a feature like that, let me try it. *****

Hey that worked, try some of your other passwords.

Re:hunter2

[El_Muerte_TDS]

Neat, let me try a longer one. Erecti0n

Re:hunter2

[Useful Wheat]

System Error:

Password too short.

Re:hunter2

[CopaceticOpus]

Neat, let me try a longer one. ********

Cool, that worked also. Do you have anything harder?

Re:hunter2

[vidarh]

If Stephen Hawking says something about physics, do you require a citation from him? Nielson is recognized as one of the leading experts in his field.

No, but if Stephen Hawking made a claim that flew in the face of established conventions in - say - psychology, I would expect a citation. Nielsen is a usability expert, not a security expert, and GP questioned his claim about the security aspect.

Re:hunter2

[adamstew]

If Stephen Hawking says something about physics, do you require a citation from him? Nielson is recognized as one of the leading experts in his field.

Yes! I would! I would want to see the research that lead him to his conclusion in physics. Or, more specifically, I would want another physicist to look at his research and give his validation to say that it's sound.

Re:hunter2

[ImaLamer]

Harder than erecti0n?

Re:hunter2

[cliveholloway]

dild0?

Two words

[RollingThunder]

Shoulder surfing.

Seriously, is this guy is supposed to be an expert?

This is like having a fuel efficiency expert tell you to turn the motor off on your car, stick it in neutral, and push it, since it'll get infinite MPG. Passwords are supposed to be secret. Usernames aren't as critical.

Re:Two words

[tomhudson]

I'd rather have to retype the occasional password than have it visible to anyone shoulder surfing.

Think about your bank card, your PIN, etc.

FTFA:

It's therefore worth offering them a checkbox to have their passwords masked; for high-risk applications, such as bank accounts, you might even check this box by default. In cases where there's a tension between security and usability, sometimes security should win.

Retarded doesn't begin to cover this. Offering a default to turn OFF password masking for bank accounts? I'm sure the banks will just LOVE this one. We have enough problems with identity theft already.

Re:Two words

[amicusNYCL]

Oh, c'mon.

So, password masking doesn't even protect fully against snoopers.

No, it doesn't protect fully, but it does protect from everyone who can't see the keyboard when you type. In other words, it protects against every shoulder-surfing scenario except when the person is looking directly at the keyboard when you type. And even then, if you're typing fast enough or the keys are close enough together you won't be able to guess the password by watching the keyboard. Hell, I'm sitting right in front of the keyboard and I still can't look through my hands to see which keys my fingertips are actually pressing. So, password masking does protect from shoulder-surfing. It might not protect against people looking directly at your keyboard, but that might be because it's designed specifically to protect against people looking at the goddamn monitor.

More importantly, there's usually nobody looking over your shoulder when you log in to a website. It's just you, sitting all alone in your office, suffering reduced usability to protect against a non-issue.

OK, so this is a great usability solution for websites that only get accessed by people sitting alone in their offices without the possibility of a co-worker standing there as they log in. For all other sites that people might access in an internet cafe, or at the airport, or in a coffee shop, or wherever else, I guess it doesn't apply at all.

Re:Two words

[mwvdlee]

Most websites (and many other applications) mask passwords as users type them, and thereby theoretically prevent miscreants from looking over users' shoulders. Of course, a truly skilled criminal can simply look at the keyboard and note which keys are being pressed. So, password masking doesn't even protect fully against snoopers.

Might as well just put all my expensive electronics on the front lawn, since a truly skilled burglar can simply pick the lock and steal it anyway. So, keeping your valuables behind closed doors doesn't even protect fully against theft. It sure as hell makes it more difficult for casual thieves though, which is probably nearly all of them.

More importantly, there's usually nobody looking over your shoulder when you log in to a website. It's just you, sitting all alone in your office, suffering reduced usability to protect against a non-issue.

Not all of us have those nice cushy jobs Mr. Nielsen has, where we have our very own office. Roughly 99.9993% of office workers have colleagues. I guess Mr. Nielsen is just a tad detached from reality here.

Re:Two words

[rtfa-troll]

Sure, being the RTFA troll, I read the article. But that still doesn't convince me. The keyboard press is a brief instant on a device which is easy to place more or less out of line of sight. A visible password on a screen is present for a long time and there are a number of interesting ways to capture this. Whilst keyboards are not perfect I think that some protection is worthwhile. One thing is for sure. Nobody is going to remember to turn this on when they are in public and your password only needs to be captured once.

One thing that might be a possible compromise is the system the mail client on my Nokia phone uses. The most recent character entered in the password is displayed for a short time. I can see each individual character, but the entire password is not exposed. I worry on the subway, but since it's a personal device it's easier to make this difficult to see.

Re:Two words

[radtea]

Retarded doesn't begin to cover this.

The best thing about the article, typical of an unfortunately large amount of usability literature, is the complete absence of empirical data. He simply asserts, for example, "users will not be confused by this" without offering a shred of empirical evidence for the claim. I'm not a typical user, but I'd sure as hell be confused if plaintext started to appear in the UI where a decade or two of experience has taught me to expect a line of bullets. I sure as hell wouldn't want to be on a helpdesk for a system that has just made this change.

Usability is an important area of software design, but it is still in its infancy, and the lack of usability experts chiming in to call this guy a blithering idiot is depressing. All claims about usability of any feature should be considered nonsense until someone comes to you with empirical data from real users that tell you what they find usable. Otherwise you're arguing mythological hypotheticals--how many users can dance on a pinhead.

How about a compromise?

[Verteiron]

Personally, I rather like the way many cellphones handle this: show the letter that was typed for a moment and THEN mask it. This allows you to spot typos and correct them without having to blank the field and start over.

Re:Um, here's a thought.

[Yetihehe]

It's possible, the only problem is with browsers. Almost all of them remember what you put in normal text fields. Next time on page - just press down arrow and voila!

One word for Nielsen: Projector

[tcsh(1)]

Ever logged in to a computer connected to an LCD projector?

Re:Not to fanboi all over the place...

[IANAAC]

Around long before the iPhone, but it was a nice try to attribute that to the iPhone.

Indeed lack of imagination

[guruevi]

1) If I look outside my office window, I can see about 48 office windows (without standing up) and all of them have the lights on and it's dusk outside. Give me a dSLR and a decent set of long distance lenses and I'll prove you wrong.

2) How many times have you typed in your password while somebody was looking at your screen eg. to show somebody something on a protected website. This happens a lot to tech people as we have to authenticate to solve an issue while somebody is standing next to me waiting for me to fix it.

3) How many times have you given a presentation where your screen view (but not your keyboard input) goes worldwide (eg. teleconference) or over a set of wires that you know haven't been tampered with (conference room) - again, logging in to your webmail or so to find a copy of your presentation.

4) How difficult is it to create a script that takes screenshots - how difficult is it to create a script that captures keyboard entry as well. Answer: the first can be done in userspace (and in the hands of an experienced script kiddie would be unnoticed), the latter usually has to go as a request to a driver, kernel or other layer that requires admin rights. This is true for Windows, Mac and (depending on your GUI) Linux

Ever typed a long WPA key into an iPhone?

[Anonymous Coward]

The cellphone method works great and has never bothered me until I had to enter a 63-character WPA key into an iPhone. This is something you can't do from memory, so you're moving your eyes back and forth between a plaintext copy, and trying to remember just where you left off. Agony.

Basically, in a few situations like this, it would be really handy to turn off masking one-time-only.

Two more words for Nielsen: Security Cameras

[hoosbane]

Just because you don't think someone is watching over your shoulder, doesn't mean someone isn't watching over your shoulder.

Re:As they say...

[nebaz]

I say "good morning" to people in the morning. You know who else said that? Mussolini. Therefore...

Re:Making my point with humor

[Profane MuthaFucka]

That comment is 99.99999% funny. It's 0.00001% true in the case of an all asterix passwd.

its not a problem for me

[circletimessquare]

i can type my password without even looking

watch, i'll enter my bank account password without looking

fluffybunnies

see? i didn't even need to...

oh crap...

unsubmit

where's the damn unsubmit!

Re:Making my point with humor

[doti]

That's because knowing the number of characters in a password greatly eases the password guessing.

The masking is indeed a bad idea. Your unix login prompt does the right thing.

You could always let the user choose

[marcus]

In a secure environment, with no one looking over my shoulder why not leave the chars in the clear?

Give 'em a checkbox: "Echo password []" which defaults to "unchecked" of course.

Re:You could always let the user choose

[Rei]

For what it's worth, I've had a password compromised before by someone looking over my shoulder at what *keys* I typed. I'd rather not make it even easier for people by letting them just look at the screen, thanks. As you note, you never know whether your environment is secure. In my case, back in TAMS, I had a "friend" who was chatting with me as an excuse to stand close enough / above me to see the keyboard; he then set up a porn site on my university account as a prank.

Strangely enough, the last I heard from him, he was becoming a Mormon missionary...

Re:You could always let the user choose

[speculatrix]

S60 has been doing this before the iPhone/iPodTouch was even a rumour within apple.

Why you have to type our WiFi password twice:

[tlambert]

Why you have to type our WiFi password twice:

The first time sends the password to my botnet.

The second time actually logs you in.

-- Terry

Re:Making my point with humor

[transporter_ii]

I think passwords should spin, and any right characters you try should make that digit stop spinning, to let you know that character was right. That would put things more in line with the movies and make hacking a lot more fun.
.

Re:Making my point with humor

[gdshaw]

Actually, the comment is (perhaps unintentionally) insightful. According to the current (25th June 2009) draft of the HTML 5 spec:

"The user agent should obscure the value so that people other than the user cannot see it."

Re:Microsoft wep key

[iPhr0stByt3]

If you mis-type the password to a wireless network, the AP won't even tell you it's wrong. That is because the AP will hopefully act as if it was correct in order to significantly slow down brute force password attempts. Windows will try to get a DHCP address and eventually come up with "limited or no connectivity". Therefore, using a double-check might save a few minutes if you can correct your typo immediately. I'm not saying that I prefer this. I'd personally rather have just one box and type it carefully, but that is a valid and good reason for this behavior.

Re:Making my point with humor

[lindseyp]

What's even better than that is when the password input window *does* have focus, and the IM window steals it just as you start to type it in.

focus-stealing windows should be banned.