Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Why does the password field not show the entered text?

When we enter password it shows ... or '*'.

What are the security advantages of this?

share|improve this question

6 Answers 6

The primary concern is to prevent "shoulder surfing", where a user is in a position where someone else may see their screen as they enter a password. You don't want users to be forced to secure their visual surroundings before entering a password, as that may not be plausible for them. It isn't always necessary, but it's a good practice.

There is some detailed analysis on the pros and cons of this practice here. (Note the many links to follow.)

share|improve this answer
    
Cannot count the number of times I've shoulder-surfed people's details. Never used them of course, but be aware of your damn surroundings people! –  Polynomial Aug 10 '12 at 6:01

Primarily, this is to prevent shoulder surfing.

While shoulder surfing is generally thought of being done in-person by someone literally looking over your shoulder, there's also the possibility of it being caught under video or photographic surveillance. This surveillance may even be authorized, as a security measure in your environment. However, the viewer's knowledge of your password would likely not be.

Granted, someone could still gather your password from watching your fingers carefully. However, it is much easier and less conspicuous to read a screen than it is to closely observe and note or memorize the motions of your fingers. Video surveillance is also often done at an angle which is not that great for recording finger movements.

Another thing this protects you from is screen capturing malware. However, this is minimal since any malware capable of reading your screen should also be presumed capable of having access to your keystrokes.

share|improve this answer

Finally a good question. There are two main advantages.

First, you know that what you're doing is different from entering other fields containing less sensitive data, you are entering a password, which by design should be kept secret. Dots or stars (before Windows XP) suggest this.

Second, if someone is standing next to you and looking at the display, they could see the password. I've also seen systems where you enter a password and each character is shown as three X's. You press H on the keyboard and it shows XXX in the password prompt. You enter HAKC and it shows as XXXXXXXXXXXX. This makes it harder for someone to know how long the password is.

share|improve this answer
    
Lotus Notes (don't laugh) is an example of an app that displays a random number of X's when you type your password to, as Matrix says, obfuscate its true length. –  queso Aug 9 '12 at 21:08

It's so that people watching your screen can't see the password as you type it.

Most of the time this isn't an issue but in the rare times where it matters it's very important.

share|improve this answer

Shoulder Surfers can't see your password when they stand behind you.

share|improve this answer

The security advantages of this is that you can see the number of letters in the password, thereby greatly reducing the attack space.

share|improve this answer
3  
Actually, that's a security dis-advantage. –  Iszi Aug 9 '12 at 21:13

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.