Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am a manager in an office where the company does not provide a company email, so I use my personal email.

Often, I will receive jobs lists by email from my general manager.

How should I log in to my email in front of my co-workers so that they don't see my password?

My email service uses end to end encryption, which means that it does not store or reset my password.

I also cannot move the screen so my co-workers cannot see it.

share|improve this question
170  
Create a new email just for work. – Neil Smithline Jan 15 at 4:40
60  
How does "end to end encryption" imply "can't reset password"? – TessellatingHeckler Jan 15 at 8:06
38  
That's the reason why password prompts usually show the same placeholder character for each character entered. Why isn't that sufficient in your case? – Philipp Jan 15 at 9:31
110  
Sort of wondering what sort of company can't be bothered to offer a vital service like emails to its staff when it's incredibly cheap. Sending emails out using a personal email address hardly comes across as professional, not to mention the security aspects for the company. – GeoffAtkins Jan 15 at 10:59
45  
My company does not provide company email what sort of company does that? – njzk2 Jan 15 at 15:54

19 Answers 19

Use the blanket of security, as seen in the Snowden documentary Citizenfour.
It involves placing a blanket over your head, the keyboard and monitor and typing in the password.
It will look weird but for security's sake it may be worth it.

Related post with demo pic - In CitizenFour, what was Edward Snowden mitigating with a head blanket?

A security blanket

share|improve this answer
48  
Worth noting that if you can touch-type your password, you don't need to put it over your head - just the keyboard. – Bobson Jan 17 at 18:20
32  
@Bobson Depends on your threat model. In the case of what Snowden was likely worried about, I'd expect hand movement under the blanket could conceivably be monitored to sufficient accuracy to allow the number of possible passwords to at least be drastically reduced. Putting the blanket over your head and the whole keyboard with no part of it touching your hands means you don't have to worry about that. – Michael Kjörling Jan 18 at 12:05
7  
@PyRulez Computer screens emit light. – Stuntddude Jan 19 at 4:59
6  
Not to mention, the vibration of the keystrokes themselves can actually give away the keys typed... using any nearby smartphone with an accelerometer... or the accelerometer in the computer itself which is there to protect the hard drive.... See cc.gatech.edu/fac/traynor/papers/traynor-ccs11.pdf – Dan Jan 20 at 6:08
9  
This seems like more of a "life-hack" answer - I can't imagine that this would seriously be considered "normal" for a manager to do in front of co-workers. – DoubleDouble Jan 21 at 20:48

You could use Two Factor Authentication that uses your phone to log in along with your password. That way, even if they see your password, they would need your phone, too to log in.

share|improve this answer
1  
Comments are not for extended discussion; this conversation has been moved to chat. – Rory Alsop Jan 20 at 10:38

Get a password manager like KeePass and store your password there. Use the auto-type or a plugin to enter the password.

  • Unlock your KeePass database when you boot your machine, so that you don't have to unlock it with people around.
  • Set it up so that it locks automatically when you lock the screen (just in case)

Alternatively, you can remember the e-mail password in your browser, which has downsides compared to KeePass but will keep your password save (given enough scrutiny).

share|improve this answer
7  
I have been using keepass and it works great. it is even available in portable form so you can carry it usb. this way it will never be stored in office. – neogeomat Jan 15 at 12:17
7  
Keep in mind that passwords stored in your browser can be trivially accessed by another person using that browser (or computer, if he/she is an administrator). – WillS Jan 16 at 0:54
3  
Sure, but now your employer can get at your passwords. They might have to read the raw RAM of the machine and dig around to find them, but it's their machine; they can do that… – Blacklight Shining Jan 16 at 4:14
29  
Physical access beats all defences. If I can tamper with your machine, I can just as well replace your KeePass installation with a fake that will send all the passwords to me once you decrypt the db. Bottom line: If you want to log in to your private e-mail on your employer's machine, you HAVE to trust the employer – Kos Jan 16 at 20:15
4  
KeePass can use any combination of a typed password, file or Windows account as part of its unlocking mechanism. Since OP is primarily worried about shoulder surfing, a file on a USB stick would be sufficient. OP would never need to type in any passwords other than for their computer's login. – Ryan Jan 20 at 16:14

While I recommend two-factor authentication on your personal account, you could set up second, work only account (as others have suggested), set up an automatic forwarding rule to it for the emails that are work related, and then log into that when necessary.

This way, you don't need to have your professional contacts update your email address, and you're only logging into an account with non-personal emails.

share|improve this answer

You should assume your employer has access to your keystrokes, so even if you do make them look away, it won't help at all. If you still insist on this false sense of security, you should become one with the tinfoil like Edward Snowden.

Schroeder and Neil have given two very good alternatives:

  1. Create a new junk email account for work.
  2. Use Two-Factor Authentication.

You could even use both 1 and 2.

share|improve this answer
7  
Both? You can't ignore this possibility, as it may be quite likely. – Mark Buffalo Jan 15 at 4:41
2  
"You should assume your employer has access to your keystrokes, so even if you do make them look away, it won't help at all." -- it doesn't follow that it doesn't help at all. Just because some colleague has physical access to install a keylogger (USB or otherwise), doesn't mean they will actually weigh up the risks and cost of making that attack, and the risks and cost of shoulder-surfing, and find them to be the same. So preventing the easiest attack actually can help a bit. You just don't know whether it will or not unless you know how motivated your colleagues are to get your password. – Steve Jessop Jan 19 at 11:33
3  
I'm talking about employers, and managers. In the IT industry, whether you realize it or not, managers "manage" people, and they generally have access to whatever it is that you're doing - including your keystrokes. They just don't tell you about it. – Mark Buffalo Jan 19 at 11:47
2  
@Scott Yeah, but OP may be unaware that management can easily keylog him. – Mark Buffalo Jan 20 at 11:23
3  
@Scott I feel you may be missing the point. I don't agree with letting someone start with a false sense of security. Part of this website is about offering different perspectives, and there may be things people haven't considered before. If the OP is worried about his password being stolen, then it follows that he should know that many employers keylog you. – Mark Buffalo Jan 20 at 17:12

My email service is end to end encryption,

Unfortunately, when logging from an untrusted computer (your company's here) this does not mean much:

  • The company may have installed the company's certificate in the trusted root of the browser you use and be proxying all the traffic through a server which essentially performs a MitM attack.
  • The company may be observing the programs' memory, logging your keystrokes, ...

which means it does not store password or reset password.

You should be able to reset your password, end-to-end encryption does not preclude resetting passwords. Select an e-mail provider/technology which allows it.

On the other hand, if you operate from an unstrusted computer, password-protecting a private key is not as effective: since the company may access any program's memory, they may access your private key after it's decoded with your password.

I can't shift the screen.

If you are worried about your team members seeing your e-mails, then you might want to bring this point to your boss; especially if they are used to send you confidential e-mails (such as discussing the performance of some of your team members, or other personal information).

However, this should have no impact on your passwords: it should never appear on screen.


In light of the fact that your company may very well be "spying" on you, and possibly legally so depending on your jurisdiction:

  • use a work-only e-mail account (do not leak your personal mails/discussions to your company)
  • use a work-only password (do not leak your preferred password to your company)

If you wish to secure said e-mail account (to prevent others from perusing your e-mails or sending them in your behalf):

  • rotate your password regularly
  • use two-factor authentication, if available
share|improve this answer
6  
preferred password is a strange thing, one should not use same password for more than one service – Sarge Borsch Jan 15 at 12:48
1  
@SargeBorsch: That's the theory, as we all know, unfortunately, password reuse is a thing. – Matthieu M. Jan 15 at 13:30
9  
At the very very least, have one password for personal stuff, and a separate one for work stuff. And a separate one for non-reputable services likely to be hacked and throwaway accounts. And…actually, just get a password manager… – Blacklight Shining Jan 16 at 4:17

Simple. Setup your separate work email. After that setup an auto-forwarding from your personal mail to your new-work-email, for senders who don't know your new email yet and then you can be confident logging that email account in front of your colleagues.

hope it helps! :)

share|improve this answer
1  
+1 was just about to suggest this. Create another email account that you only use for work and hence don't care if your partners see or even use it. Using your personal email as an official part of your job is a problem just waiting to happen, regardless of this particular question. – Wayne Jan 16 at 0:57
1  
DO NOT DO THAT. If you set up forwarding, compromising your work e-mail means getting full access to all accounts linked to the personal one, using the "I forgot the password" feature. – d33tah Jan 22 at 19:24
    
@d33tah, you could just forward e-mails based on filters, e.g. coming from known senders or specific keywords. That way you won't forward those such ones that help you reset the password of the original account. – smarinov Feb 6 at 21:22

A YubiKey is capable of storing a fixed string that can be activated. Make your password a combination of the a random character string that is on the YubiKey and your typed password. It's not quite two factor authentication, but it does mean shoulder surfing the keyboard alone won't be enough to get your password.

If you use GMail, they integrate with U2F and TOTP generators, in which case you can actually use proper 2 factor authentication.

share|improve this answer
5  
This still leaves you open to a keylogger installed on the machine, though. – Blacklight Shining Jan 16 at 4:18
5  
@BlacklightShining Physical access defeats any measure you can take. If you can't trust the machine, there's no way to authenticate yourself to the email service or trust anything. – Martijn Heemels Jan 20 at 10:20
    
@BlacklightShining A passive keylogger will not break U2F because it uses public key crypto. – Navin Jan 21 at 22:39

You could always learn to use the Dvorak Keyboard Layout! You will rarely encounter anyone watching over your shoulder familiar with this layout. I use it and I've never encountered anyone who could tell what I was typing even if I slowly pecked away with my index finger one key at a time.

share|improve this answer
3  
But if you look at what you type and type it again, I'll use your password even if the keyboard layout is different. – A.L Jan 17 at 2:09
20  
this is the "lucky charms decoder ring" level of security. – djechlin Jan 18 at 3:10
    
Even if the don't get it by looking directly they could use a camera and decipher afterwards. – Christian Jan 18 at 11:28
    
better yet, make your own. that's what I did... – smpl Jan 25 at 6:59

Buy a simple fingerprint scanner or use a laptop with fingerprint scanner (pretty common now a days), then use a password manager to store your password for that email service and login with a swipe of your finger.

I do that all the time with HP Client Security.

And that looks more hi-tech than awkward like many other solutions do in front of other people :)

share|improve this answer
2  
A fingerprint is not a password, at best it's a user id. You leave it behind on almost everything you touch, and how can you change your "password" finger in the future? New fingers? – Xen2050 Jan 21 at 3:12
    
Probably have not used that feature ever?. Niether did i mean it is a password nor does grabbing a fingerprint from somewhere else works fine on a computer fingerprint swipe scanner in real life. You can change password anytime you want and your password manager will know the new password if you tell it. – Hanky Panky Jan 21 at 5:14
3  
And in an office if other people are so determined to snatch your password that they will take your fingerprints from the door knob and then generate a mold and then login to your computer then you might not as well be there in the first place looking for an answer to this question. Wouldn't such people easily take off the blanket off your head like suggested in the top answer? – Hanky Panky Jan 21 at 5:16
    
The question reads How should I securely type a password in front of a lot of people? and not How do I protect my password from a lot of hostile spies in my office? – Hanky Panky Jan 22 at 7:17
1  
I upvoted this answer because as an I.T. guy, I frequently have people over at my desk. It's very convenient to just swipe my finger to unlock the computer. You don't want people to see what keys you are typing on your keyboard, but you also don't want to make them feel like you don't trust them. The fingerprint reader is awesome. – Quixrick Jan 22 at 15:37

You can use AutoHotKey and replace the full or parts of the password automatically while typing. I was using this method before I switched to KeePass and used Auto-Type.

::pop::part0fP4$$w0rD

That way, users seeing you type will only know parts of the password, not the full password. Disadvantage: the second half of the password is stored in a file. To mitigate that a bit, I made the replacement longer than needed and delete a few characters using backspace.

share|improve this answer

When I enter a PIN code in a grocery store, I fake a few extra key-presses between the real ones, by putting my finger on the key but not pushing it. It's especially convenient when the keys don't visibly move much (as in the case of almost all keypads I've encountered on card scanners and ATMs), but with some practice it can be done with a standard computer keyboard.

It doesn't help against people who are trained and dedicated to spy on you, or use a camera and watch it later in slow motion, but it provides a good protection against casual glances.

share|improve this answer
    
If you are touch typing a fake hit on a bottom row key should be basically impossible for an observer to detect unless they can also note that no * appeared in the password box when you "hit" that key. – Loren Pechtel Jan 22 at 22:41

If you want to visually block shoulder-surfers but don't want to go full blanket-over-head-and-PC for the obvious appearance downsides, you could get a similar level of protection with less awkwardness by putting a smaller cloth over just your hands while you touch-type your password. Still awkward, but not as glaringly so. A password manager plus MFA is still generally the best choice in this scenario.

share|improve this answer
3  
I'd appreciate if the downvoter/delete voter(s) would explain why they think this is both a bad answer and an invalid answer instead of just throwing a delete request at it. – pydsigner Jan 19 at 23:56

No blankets over your head required - just cover up a small section of the keyboard with your other hand, while typing in your password.

This would work excellent if you had all the letters on one side of the keyboard, or a numbers-only password, and have a number pad on the keyboard to type it in with. Very much like you're supposed to do at an ATM machine.

Like this photo too, (only do a better job ;-) enter image description here

All the caveats about your employer or company being able to monitor every keystroke and all network traffic apply, but this will keep prying eyes off at least.

share|improve this answer

As others have said, anyone in your office can just either install software on your PC, or plug in a physical keylogger between your PC and your keyboard. Of the solutions mentioned so far, only 2 factor authentication provides reasonable defense against physical access. But tampering with a computer to find somebody else's password is a criminal offence in many places and will also get people fired if caught, so the chance that they will do that is significantly lower than them just looking at your keyboard while you type.

Of the solutions mentioned so far, only 2 factor authentication provides reasonable defense against physical access.

The one solution which is missing is: BYOD. Bring in your own laptop, tablet or phone to access your email. That device uses an email client that has already stored your password, and the device requires a pin, fingerprint, or eye reading to unlock.

share|improve this answer

Snce you are asking..

1) shroud the keyboard. Learn to type blindly, accordion style.

2) implement opie style single use passwords.

3) login using keypairs via an ssh tunnel or similar.

4) try really hard not to mumble the password audibly as you type.

5) periodically scan for ultrasonic modem noise, unusual RF activity.

6) be acuteley aware of reflective surfaces, mirrors, glass.

7) DO NOT type it into unmasked fields accidentally.

8) Momentarily re-map your keyboard.

9) or just don't do it in public. etc. etc.

share|improve this answer

My proposal requires support on the server. If your service provider does provide this service (or if they are willing to), this doesn't actually answer the direct question (how to prevent the passphrase from being seen) but actually addresses the problem that most people try to solve (which is how to authenticate without revealing details that allows someone else to authenticate). The secret is to...

Don't worry if they get your password.

There is technology called OTP (One-Time Password), such as the S/Key implementation, which allows you to type in a password onto a trusted device. The trusted device uses some software, such as skeyinit (on Unix-like platforms -- skyinit man page) or OTPDroid (an open source option on Android platform) to generate a series of words. Then, you don't need to care if anyone thinks they saw your typed password, or even if there is a keyboard logger, because that series of words is only valid once.

If you can't type on your phone safely, another option (if you have foresight) is to generate the list of words ahead of time, and store them somewhere (maybe even using pen and paper). Then you can look at the pre-generated note that reminds you what words will need to be typed.

share|improve this answer

Ask your co-workers politely to turn around for a second. In a working environment nobody should be surprised or complain.

share|improve this answer
    
Any work environment people should not wonder if you ask them not to spot on the keyboard while one enters credentials... – user98946 Feb 2 at 20:13

Get yourself a cheap barcode scanner, attach it to your computer and configure it as a "keyboard wedge" so it pretends it is a simple keyboard.

enter image description here

Print your password as a barcode (there are many free barcode fonts around) and stick that in a pocketbook you carry on your person.

Whenever you need to log-in, reach out your book, open it, scan the barcode and close the book.

share|improve this answer
9  
But then, surely anyone who simply has a camera-enabled phone in your vicinity can silently snap a picture and then decode your password at their convenience? – This isn't my real name Jan 18 at 22:42
2  
@Thisisn'tmyrealname Yes. :) The crux is whether your staff would do this. Your call. – OldCurmudgeon Jan 19 at 0:33
6  
But doesn't the fact of the question itself imply an environment where you would have to be concerned about this? – This isn't my real name Jan 19 at 3:53
5  
Instead of this, I'd suggest programming a Yubikey with a static random string. The Yubikey simply emulates a keyboard. Append the string to the password you have memorized. When you need to enter your password, first type the part from memory, then insert the Yubikey into a USB slot and touch the button. It will enter the static string to complete the full password and hit enter. A key is easier to keep on your person and less obvious than scanning a barcode. Here's a tutorial: yubico.com/products/services-software/personalization-tools/… – Martijn Heemels Jan 20 at 10:28
    
This just leaves the book as a security weakness. This can be partially overcome by having multiple barcodes, you scan a few to build up your password. The keyspace you can reasonably make this way is too small for real security but anti-flood measures should make it not work very well. – Loren Pechtel Jan 22 at 22:44

protected by Community Jan 15 at 20:36

Thank you for your interest in this question. Because it has attracted low-quality or spam answers that had to be removed, posting an answer now requires 10 reputation on this site (the association bonus does not count).

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.