Slashdot Mirror
Ask Slashdot: Is Password Masking On Its Way Out?
New submitter thegreatbob writes: Perhaps you've noticed in the last 5 years or so, progressively more entities have been providing the ability to reveal the contents of a password field. While this ability is, in many cases (especially on devices with lousy keyboards), legitimately useful, it does seem to be a reasonable source of concern. Fast forward to today; I was setting up a new router (cheapest dual-band router money can, from Tenda) and I was almost horrified to discover that it does not mask any of its passwords by default. So I ask Slashdot: is password masking really on its way out, and does password masking do anything beyond preventing the casual shoulder-surfer?
"does password masking do anything beyond preventing the casual shoulder-surfer?"
Erm...that is precisely ALL it has ever done?! What else do you think it does?
Frankly, most password boxes should have a 'show' password option because its user friendly -- put the user in charge of whether or not the password is visible -- they can decide the risk of exposure.
Although i do think showing it by default is a bit absurd. On the other hand, with a new router out of the box; the default password is a known quanity or on the labelling anyway... so not a lot of harm exposing it there.
" is password masking really on its way out, and does password masking do anything beyond preventing the casual shoulder-surfer?"
It makes it much more likely to make a typo and have to try again.
"National Security is the chief cause of national insecurity." - Celine's First Law
The only interesting thing here is that you discovered a cheapo home device that doesn't mask passwords, fortunately in a situation (i.e. at home) when shoulder surfing is a non-issue anyway.
Come back when you've got more than one data point, eh?
If God forks the Universe every time you roll a die, he'd better have a damned good memory.
My favorite is trying to enter 15 character randomized passwords into a "force mask" field. The algorithm always seems to pick confusing characters like `'|][;: I often have no idea if I'm even attempting to enter the correct password, let alone if all the rando miscreant characters were entered as intended.
Man, you really need that seminar!
No, it is not going away, because it is more than just shoulder surfers that look at your screen. For example when you need to login while projecting the screen in a conference room, or sharing it during an online meeting. Now, get off my lawn. Please.
Sig ?
"correct horse battery staple" would like to disagree with you. The reality is that putting in special characters, mixed case, and numbers doesn't do nearly as much to increase password complexity compared to simply making them longer. For the network I operate, I now just have a policy of a minimum of 12 characters. I tell my users to make up a silly little rhyme or ditty that they can remember, and use that as their password. Easy to remember, hard to crack, and easy to type.
...si hoc legere nimium eruditionis habes...
Make it a bunch of asterisks.
Done.
File under 'M' for 'Manic ranting'
If you get a password field on a web page the browser will display various scary looking messages depending of the security of the page.
Generally if its a local network page with an IP address (most router interfaces) having the password field will have the browser alert you the page is "Not Secure" of the address bar. If its a self signed certificate (which ads encryption between you and the browser, the message is even scarier with red fields or strikethroughs as a spoofed certificate COULD be playing a man in the middle confidence scheme. Only ones that get through this is devices that have set up proper certification.
So the easiest way to avoid a lot of the scary "not secure" address bar messages, is just do the login in plain text.
"Enjoy what you're doing! If it becomes drudgery, you're doing it wrong!" - Jim Butterfield
Allowing the password to be revealed is an unwanted security risks to some parano- er... cautious folk and corporations. For one, it means that the password could be picked up by a larger portion of malware, e.g. screen grabbers and rogue browser extensions that are allowed to read the DOM.
Second, it means that the password isn't hashed, but either encrypted or stored in plain text somewhere on disk. A hashed password (with a random salt, to thwart rainbow tables) is generally harder to reverse than an encrypted password.
In an enterprise setting, when important passwords can't be revealed it makes more sense to keep them in a safe or a password manager, access to which could be easier to manage.
But when you can't remember your Wi-Fi password for your guests, maybe convenience outweighs security.
Fingerprints are not passwords. They are a what-you-are authentication factor. Passwords are a what-you-know.
It means that fingerprints can only be used to tell that the one operating the device with the scanner is you. They can't be used directly for remote authentication, because they are not secret.
TFA seems to believe that since they can't think of a purpose for masking, and that a single (in their words "cheapest money can" [I assume they meant] "buy") home router doesn't use masking, that it must be the end of a field that's been in HTML for as long as HTML has had a standard.. Training sessions, remote support sessions, documentation, and yes preventing shoulder surfing are all reasons that the password field type will probably never go away.
-The wise argue that there are few absolutes, the fool argues that there are no probabilities.
If your computer can scan it to let you in, someone else's computer can scan it to let them take a copy.
Someone had to do it.
I pick up the occasional used router and noticed it was pretty easy to recover the SSID, WPA2 password, and the admin password.
I did a presentation on this last month and it was well received. We got used routers from the local thrift store or electronics recycle, opened it up and hooked up to the UART serial console. Most of them boot you to a command prompt with no password. Then you can run "nvram show | grep pass" or wpa or admin and you will get the prior owner's SSID, and passwords.
There is a good chance that this person probably turned in this router after upgrading their router at home. It is probably unlikely they changed the Wifi passwords on all of their IoT, Web Cams, mobile devices, Blueray, laptop whatever at home. So just plug in the SSID to wigle net and you can go see what is on their webcam.
hey, if you type in your pw, it will show as stars
<Cthon98> ********* see!
<AzureDiamond> hunter2
<AzureDiamond> doesnt look like stars to me
<Cthon98> <AzureDiamond> *******
<Cthon98> thats what I see
<AzureDiamond> oh, really?
<Cthon98> Absolutely
<AzureDiamond> you can go hunter2 my hunter2-ing hunter2
<AzureDiamond> haha, does that look funny to you?
<Cthon98> lol, yes. See, when YOU type hunter2, it shows to us as *******
<AzureDiamond> thats neat, I didnt know IRC did that
<Cthon98> yep, no matter how many times you type hunter2, it will show to us as *******
<AzureDiamond> awesome!
<AzureDiamond> wait, how do you know my pw?
<Cthon98> er, I just copy pasted YOUR ******'s and it appears to YOU as hunter2 cause its your pw
<AzureDiamond> oh, ok.
Obligatory Nuclear Launch Codes: 0-0-0-0-0-0
honestly if you want people to use complex passwords you have to show them the freaking string as they type
ASDq3fwtevybtynsR&56@%^25tqer7gRT*Ubt&tferyweF
for their password
Dammit, how did you get my password?
#DeleteChrome