Throwing Out Password Masking With the Bathwater

A recent and highly publicized blog is recommending that we stop the practice of password masking. The argument made by the author is that password masking offers little to no security benefit while at the same time creating a frustrating user experience. Even security-famed Bruce Schneier has weighed in on the topic. Specifically, the author notes the following:

  • Users make more errors when they can’t see what they are typing
  • Users are more likely to get frustrated or feel less confident, and so abandon their login
  • To get around these problems, users are more likely to employ insecure password practices such as using overly-simple passwords, or copying and pasting passwords from other locations

The author further states that the primary claimed advantage for masking passwords – that it prevents shoulder surfers from seeing what you type – creates a false sense of security. He correctly points out that a skilled or determined shoulder surfer would simply watch the keys you type, without having to see the characters appear on the screen.

In addition to the author’s points, I would add that masked passwords make it difficult for the user to know if they accidentally have caps-lock enabled. And, lacking any feedback about their typos, users are more likely to accidentally lock their accounts after too many failed logins. This creates not only a negative user experience, but also an unnecessary strain on technical support when they get called about the locked accounts.

All of the author’s points are valid, but in many cases the problem is overstated, the benefits are understated, and the conclusion falsely assumes binary options.

First, the problems described for password masking are exaggerated worst-case scenarios. How often do you really think users get so frustrated with masked passwords that they abandon the site resulting in lost revenue to the site’s owner? Or more pointedly, how often should such problems be attributed to the password masking itself, and not some other poor user interface design? I’m not saying it doesn’t happen, I am just skeptical that the problem is as large as the author claims.

Second, some benefits of password masking are overlooked. The author claims only one benefit – preventing the malicious shoulder surfer from seeing your password on screen – and then argues that this person will just watch you type the keys on your keyboard instead. Here are some additional benefits not explored by the author:

  • Depending on your typing speed, watching keys as they are typed is more difficult than reading a password onscreen – especially for weak passwords. Someone attempting to watch you type keys is more likely to fail in capturing the entire password, or will require additional tools (e.g. video cameras) to assist him. Masking passwords may not be a perfect solution, but it’s not valueless either.
  • Accidental password exposure is probably a bigger problem than intentional shoulder surfers. When you are making that next big presentation to coworkers and clients via the office projector, a web share, or within your cube, will you remember to blank your screen before you log in? Or would you prefer to ask your audience to all close their eyes briefly while you log in? Or perhaps you trust them to see your password?

Finally, the author presents the problem as if the solution is binary – we either mask passwords, or we don’t. As some Mac OS X users will tell you, this is a false dichotomy. For example, when setting up a new wireless internet connection, the Mac gives you the option to display the typed or stored password. By default the password is masked, but the user has the option to override this, which can be helpful when you aren’t sure if you fat fingered the password field. Apple doesn’t use this feature everywhere, but perhaps it should.

In conclusion, if you are considering unmasking passwords, make sure you aren’t throwing the baby out with the bath water. The points made by the author have validity, but they describe an opportunity to improve the existing practice of password masking, not a valid reason for abandoning the practice entirely.

56 replies
  1. free christian web hosting
    free christian web hosting says:

    I’m really enjoying the design and layout of your website. It’s a very easy on the eyes which makes it much more pleasant for me to come here and visit more often. Did you hire out a designer to create your theme? Exceptional work!

  2. yoga ashram
    yoga ashram says:

    I’m still learning from you, but I’m trying to reach my goals. I definitely liked reading all that is posted on your site.Keep the stories coming. I enjoyed it!

  3. dietas
    dietas says:

    I think this is among the most significant info for me. And i am glad reading your article. But should remark on few general things, The website style is wonderful, the articles is really great : D. Good job, cheers

  4. click this link here now
    click this link here now says:

    It’s appropriate time to make some plans for the future and it’s time to be happy. I have read this submit and if I may just I wish to counsel you few attention-grabbing things or advice. Perhaps you can write subsequent articles regarding this article. I desire to read even more things approximately it!

  5. click resources
    click resources says:

    I’m typically to blogging and i actually respect your content. The article has actually peaks my interest. I’m going to bookmark your site and hold checking for new information.

  6. additional info
    additional info says:

    of course like your web site however you need to test the spelling on quite a few of your posts. A number of them are rife with spelling problems and I in finding it very bothersome to tell the reality however I will surely come again again.

  7. privacy screening
    privacy screening says:

    Hello, I think your website might be having browser compatibility issues. When I look at your blog in Safari, it looks fine but when opening in Internet Explorer, it has some overlapping. I just wanted to give you a quick heads up! Other then that, amazing blog!

  8. party menu kent
    party menu kent says:

    Hey very nice web site!! Man .. Excellent .. Amazing .. I will bookmark your blog and take the feeds also…I am happy to find numerous useful information here in the post, we need develop more strategies in this regard, thanks for sharing. . . . . .

  9. site
    site says:

    magnificent post, very informative. I wonder why the other specialists of this sector do not notice this. You should continue your writing. I am sure, you’ve a huge readers’ base already!

  10. go
    go says:

    I’d have to examine with you here. Which is not one thing I usually do! I take pleasure in reading a post that may make folks think. Additionally, thanks for permitting me to comment!

  11. next page
    next page says:

    Hello just wanted to give you a quick heads up and let you know a few of the images aren’t loading properly. I’m not sure why but I think its a linking issue. I’ve tried it in two different browsers and both show the same outcome.

  12. amarres de amor
    amarres de amor says:

    When I originally commented I clicked the “Notify me when new comments are added” checkbox and now each time a comment is added I get several e-mails with the same comment. Is there any way you can remove me from that service? Bless you!

  13. challenge coin manufacturers usa
    challenge coin manufacturers usa says:

    I just wanted to send a brief note to be able to thank you for these unique points you are posting at this site. My particularly long internet look up has finally been compensated with really good tips to talk about with my great friends. I ‘d tell you that most of us visitors are definitely endowed to exist in a remarkable website with very many lovely people with interesting methods. I feel rather lucky to have seen the site and look forward to many more awesome moments reading here. Thank you once more for a lot of things.

  14. internet dedicado preço
    internet dedicado preço says:

    Hello there, just became alert to your blog through Google, and found that it’s really informative. I am going to watch out for brussels. I will appreciate if you continue this in future. Numerous people will be benefited from your writing. Cheers!

  15. South Coast Canna
    South Coast Canna says:

    whoah this weblog is wonderful i like studying your articles. Keep up the good paintings! You understand, lots of individuals are hunting around for this information, you could help them greatly.

  16. Atlanta Auto Wreck Attorney
    Atlanta Auto Wreck Attorney says:

    With havin so much content and articles do you ever run into any issues of plagorism or copyright violation? My blog has a lot of completely unique content I’ve either authored myself or outsourced but it appears a lot of it is popping it up all over the internet without my agreement. Do you know any solutions to help protect against content from being stolen? I’d really appreciate it.

  17. fotografo profissional
    fotografo profissional says:

    Thanks, I have recently been searching for info approximately this topic for a long time and yours is the best I’ve discovered till now. However, what in regards to the conclusion? Are you sure concerning the supply?

  18. site web
    site web says:

    Thank you for another excellent post. Where else could anyone get that type of info in such a perfect way of writing? I have a presentation next week, and I’m on the look for such info.

  19. South Coast Canna
    South Coast Canna says:

    Greetings from Idaho! I’m bored to tears at work so I decided to browse your site on my iphone during lunch break. I love the info you provide here and can’t wait to take a look when I get home. I’m surprised at how fast your blog loaded on my cell phone .. I’m not even using WIFI, just 3G .. Anyhow, great site!

  20. Local Accident Report
    Local Accident Report says:

    You could definitely see your enthusiasm within the paintings you write. The world hopes for even more passionate writers such as you who are not afraid to say how they believe. All the time go after your heart.

  21. Homeopathy
    Homeopathy says:

    When I originally commented I clicked the -Notify me when new comments are added- checkbox and now each time a comment is added I get four emails with the same comment. Is there any way you can remove me from that service? Thanks!

  22. tudo sobre sipat
    tudo sobre sipat says:

    I used to be suggested this website by means of my cousin. I’m not positive whether or not this submit is written by him as nobody else recognize such specific about my difficulty. You are amazing! Thank you!

  23. ?buat kolam renang murah
    ?buat kolam renang murah says:

    After examine a number of of the blog posts in your web site now, and I actually like your way of blogging. I bookmarked it to my bookmark website record and can be checking back soon. Pls try my web page as effectively and let me know what you think.

  24. elton water heater service center malaysia
    elton water heater service center malaysia says:

    Awesome blog you have here but I was wanting to know if you knew of any forums that cover the same topics discussed here? I’d really love to be a part of community where I can get comments from other knowledgeable individuals that share the same interest. If you have any suggestions, please let me know. Many thanks!

  25. inca jungle
    inca jungle says:

    This web page is mostly a stroll-by for the entire data you wanted about this and didn’t know who to ask. Glimpse right here, and also you’ll undoubtedly uncover it.

  26. Renea Bazil
    Renea Bazil says:

    I am really impressed together with your writing skills as well as with the structure to your blog. Is this a paid topic or did you modify it yourself? Either way stay up the excellent high quality writing, it’s uncommon to peer a nice blog like this one nowadays.. Auto Peças Jacareí

  27. แทงบอลออนไลน์
    แทงบอลออนไลน์ says:

    Thank you for sharing excellent informations. Your site is so cool. I’m impressed by the details that you have on this blog. It reveals how nicely you understand this subject. Bookmarked this website page, will come back for extra articles. You, my friend, ROCK! I found simply the info I already searched all over the place and just could not come across. What an ideal site.

  28. Harbor
    Harbor says:

    A powerful share, I simply given this onto a colleague who was doing a little bit analysis on this. And he actually purchased me breakfast as a result of I found it for him.. smile. So let me reword that: Thnx for the treat! But yeah Thnkx for spending the time to discuss this, I really feel strongly about it and love reading more on this topic. If potential, as you become expertise, would you mind updating your weblog with extra details? It’s highly helpful for me. Massive thumb up for this blog post!

  29. Showflat
    Showflat says:

    What’s Happening i’m new to this, I stumbled upon this I’ve found It absolutely helpful and it has aided me out loads. I’m hoping to contribute & assist different customers like its aided me. Good job.

  30. Parc Canberra EC
    Parc Canberra EC says:

    I was curious if you ever considered changing the layout of your website? Its very well written; I love what youve got to say. But maybe you could a little more in the way of content so people could connect with it better. Youve got an awful lot of text for only having one or two images. Maybe you could space it out better?

  31. immobilie gutachten
    immobilie gutachten says:

    What i do not understood is in fact how you are not actually a lot more neatly-preferred than you might be right now. You’re very intelligent. You realize therefore considerably in relation to this subject, made me individually imagine it from a lot of varied angles. Its like men and women don’t seem to be fascinated except it is something to accomplish with Woman gaga! Your individual stuffs excellent. All the time handle it up!

  32. immobilie bewerten
    immobilie bewerten says:

    Very nice article and right to the point. I don’t know if this is truly the best place to ask but do you people have any ideea where to employ some professional writers? Thank you 🙂

Leave a Reply

Want to join the discussion?
Feel free to contribute!

Leave a Reply

Your email address will not be published.