Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I just read this article about unmasking passwords at sign up for usability reasons. On the surface it seems reasonable to me, but I'm wondering what additional security concerns that might generate, if any.

share|improve this question
    
Masking doesn't prevent keylogging... Just shoulder surfing. –  Fiasco Labs Oct 29 '12 at 15:18

3 Answers 3

up vote 10 down vote accepted

Masking password fields is designed to prevent shoulder-surfing, where an attacker watches you type in a password. Unmasking is a bad idea in public, but it's not so bad in signup scenarios when the user is alone in the room. Whilst I personally disagree with the assertion that users are incapable of typing in a password correctly twice in succession, I'll go along with it for the purpose of this question.

I think the security concerns are covered quite well in some of the comments.

Luca Rosaldi said:

Another good approach (IMHO) would be including the “show password” checkbox, but checked by default. This way, if I’m alone I could check my password without concerns for security, or if I’m not I could uncheck the box and type my password.

To which Ray McCord replied:

It should be exactly the opposite.

It must be masked by default and the user must have to take an explicit action to unmask it — and even then that choice should be honored only very temporarily before reverting to masked.

Why?

Because this password form is acting as your agent and it, therefore, must be made to act in your best interest first — like a bodyguard.

This is a decent compromise - the default is to provide the user with the maximum possible security. If the user decides that it's just too damn hard to put their password in correctly, they can opt to sacrifice security for usability. This has the extra benefit of not patronising users that are perfectly capable of typing properly.

The biggest problem isn't really a security one, but rather a confidence one. Tesmond put it perfectly:

Simply displaying the password field is very uncommon behaviour, it instantly creates cognitive dissonance and perhaps even instant panic as your “secret” password is displayed for all on lookers. You may worry that your password will be visible in all places within the application and may even make you change your password to a less memorable one.

This actually creates a security problem. If you saw your password appear unmasked, you'd be a little confused as to why the site decided to buck the trend. Perhaps they don't care about security? Perhaps they store it in plaintext?! Perhaps your password will be visible on every screen!!? The user will then pick a terrible password that they don't care about having compromised, which puts their account at risk.

share|improve this answer
    
Sometimes it is difficult to type the password correctly - think about smartphones and such. –  AviD Oct 29 '12 at 15:36
1  
@AviD I'd argue that that's a usability issue with the keypad, not the password box. –  Polynomial Oct 29 '12 at 15:57
2  
I would agree with you. However, the website designer can either choose to account for it, and work around it, or ignore it and shut off that whole segment. So working around it, securely, is a good requirement in my mind. –  AviD Oct 29 '12 at 16:06
    
I agree. Was just pointing out that, at the end of the day, the root cause is the keypad itself. –  Polynomial Oct 29 '12 at 16:13
    
I was just referring to this line: Whilst I personally disagree with the assertion that users are incapable of typing in a password correctly twice in succession. –  AviD Oct 29 '12 at 16:29

To be honest I'd say that the article, in combination with the comments on it cover most of the likely security concerns.

As stated the usual security concern for displaying passwords is a "shoulder-surfing" attack where someone can overlook a user and thereby get unauthorised access to their password.

Obviously this risk is only present in environments where the user can be overlooked (e.g. offices, coffee shops, etc).

I'd largely agree with the opinion expressed by some of the commenters that there's a balance to be had here between security and usuability. I'd say that an approach which requires the user to actively uncover the password (and which only works temporarily) is a reasonable trade-off. this could be similar to the windows 8 approach where an icon on the password field can be clicked to reveal the password, but the password is only shown so long as the user holds down the mouse button over that icon.

share|improve this answer

The main concern is people snooping over the shoulder, as the article correctly states. In theory, the only difference, when using password masking, is the way the password gets displayed to the user, other than that, on the software level should be is no real difference. However, if the browser doesn't know that a field contains a password or other sensitive data it might behave differently, for example storing the password in a non secure way, as part of the forms auto-fill feature.

share|improve this answer
    
This is already a problem with other sensitive fields. I've had to go hunting more than once for where autocomplete data was stored after discovering that some site's plaintext entry field had resulted in the browser remembering my SSN. –  Dan Neely Oct 29 '12 at 17:28

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.