Feeds

Masked passwords must go

'Shoulder surfing is largely a phantom problem'

Website security in corporate America

Websites should stop masking passwords as users type because it does not improve security and makes websites harder to use, according to two of the technology world's leading thinkers.

Usability expert Jakob Nielsen and security expert Bruce Schneier both think websites should stop blanking out passwords as users type them in. They say the practice inconveniences users and delivers no security benefits.

Most websites that require passwords allow a user to see the login name as it is typed in but replace the password with dots or asterisks as it is typed, so that the password cannot be viewed either by another person looking at the screen or by the user.

"It's time to show most passwords in clear text as users type them," said Nielsen in a post on his website. "Providing feedback and visualizing the system's status have always been among the most basic usability principles. Showing undifferentiated bullets while users enter complex codes definitely fails to comply."

Nielsen is the web's most famous usability guru and campaigns for content and websites to conform to technical standards to be usable and accessible for all users, including disabled users using assistive technologies.

Schneier, a renowned IT security expert, echoed Nielsen's concerns, and supported Nielsen's assertion that password masking does nothing to improve security.

"Password masking has annoyed me for years," Schneier told OUT-LAW.COM. "Shoulder surfing is largely a phantom problem, and people know to be alert when others are nearby, but mistyping a long password happens all the time."

Double degradation

Nielsen said that research had shown that password masking causes problems for users. "Password masking has proven to be a particularly nasty usability problem in our testing of mobile devices, where typing is difficult and typos are common. But the problem exists for desktop users as well," he said.

Preventing users from seeing the passwords they type in causes two problems, according to Nielsen. "Users make more errors when they can't see what they're typing while filling in a form. They therefore feel less confident. This double degradation of the user experience means that people are more likely to give up and never log in to your site at all, leading to lost business," he said.

"The more uncertain users feel about typing passwords, the more likely they are to (a) employ overly simple passwords and/or (b) copy-paste passwords from a file on their computer. Both behaviors lead to a true loss of security," he said.

Schneier agreed that masking passwords was likely to result in a weakening of security. "I'm sure people choose shorter and easier to type password when their typing is masked, resulting in less security overall," he said.

Nielsen said that sites usually blank out type-in passwords out of force of habit rather than reason. "Password masking has become common for no reasons other than (a) it's easy to do, and (b) it was the default in the web's early days," he said.

He acknowledged that shoulder surfing is a risk in some environments, such as internet cafés. "It's therefore worth offering them a checkbox to have their passwords masked; for high-risk applications, such as bank accounts, you might even check this box by default," he suggests. "In cases where there's a tension between security and usability, sometimes security should win."

See also
Nielsen's Alertbox on password masking
Bruce Schneier's blog

Copyright © 2009, OUT-LAW.com

OUT-LAW.COM is part of international law firm Pinsent Masons.

Protecting users from Firesheep and other Sidejacking attacks with SSL

More from The Register

next story
'Kim Kardashian snaps naked selfies with a BLACKBERRY'. *Twitterati gasps*
More alleged private, nude celeb pics appear online
Hackers pop Brazil newspaper to root home routers
Step One: try default passwords. Step Two: Repeat Step One until success
UK.gov lobs another fistful of change at SME infosec nightmares
Senior Lib Dem in 'trying to be relevant' shocker. It's only taxpayers' money, after all
Spies would need SUPER POWERS to tap undersea cables
Why mess with armoured 10kV cables when land-based, and legal, snoop tools are easier?
TOR users become FBI's No.1 hacking target after legal power grab
Be afeared, me hearties, these scoundrels be spying our signals
Snowden, Dotcom, throw bombs into NZ election campaign
Claim of tapped undersea cable refuted by Kiwi PM as Kim claims extradition plot
Freenode IRC users told to change passwords after securo-breach
Miscreants probably got in, you guys know the drill by now
THREE QUARTERS of Android mobes open to web page spy bug
Metasploit module gobbles KitKat SOP slop
BitTorrent's peer-to-peer chat app Bleep goes live as public alpha
A good day for privacy as invisble.im also reveals its approach to untraceable chats
prev story

Whitepapers

Secure remote control for conventional and virtual desktops
Balancing user privacy and privileged access, in accordance with compliance frameworks and legislation. Evaluating any potential remote control choice.
WIN a very cool portable ZX Spectrum
Win a one-off portable Spectrum built by legendary hardware hacker Ben Heck
Storage capacity and performance optimization at Mizuno USA
Mizuno USA turn to Tegile storage technology to solve both their SAN and backup issues.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
The next step in data security
With recent increased privacy concerns and computers becoming more powerful, the chance of hackers being able to crack smaller-sized RSA keys increases.