129

I am a manager in an office where the company does not provide a company email, so I use my personal email.

Often, I will receive jobs lists by email from my general manager.

How should I log in to my email in front of my co-workers so that they don't see my password?

My email service uses end to end encryption, which means that it does not store or reset my password.

I also cannot move the screen so my co-workers cannot see it.

  • 185
    Create a new email just for work. – Neil Smithline Jan 15 '16 at 4:40
  • 66
    How does "end to end encryption" imply "can't reset password"? – TessellatingHeckler Jan 15 '16 at 8:06
  • 42
    That's the reason why password prompts usually show the same placeholder character for each character entered. Why isn't that sufficient in your case? – Philipp Jan 15 '16 at 9:31
  • 120
    Sort of wondering what sort of company can't be bothered to offer a vital service like emails to its staff when it's incredibly cheap. Sending emails out using a personal email address hardly comes across as professional, not to mention the security aspects for the company. – GeoffAtkins Jan 15 '16 at 10:59
  • 57
    My company does not provide company email what sort of company does that? – njzk2 Jan 15 '16 at 15:54

20 Answers 20

221

Use the blanket of security, as seen in the Snowden documentary Citizenfour.
It involves placing a blanket over your head, the keyboard and monitor and typing in the password.
It will look weird but for security's sake it may be worth it.

Related post with demo pic - In CitizenFour, what was Edward Snowden mitigating with a head blanket?

A security blanket

  • 53
    Worth noting that if you can touch-type your password, you don't need to put it over your head - just the keyboard. – Bobson Jan 17 '16 at 18:20
  • 43
    @Bobson Depends on your threat model. In the case of what Snowden was likely worried about, I'd expect hand movement under the blanket could conceivably be monitored to sufficient accuracy to allow the number of possible passwords to at least be drastically reduced. Putting the blanket over your head and the whole keyboard with no part of it touching your hands means you don't have to worry about that. – a CVn Jan 18 '16 at 12:05
  • 7
    @PyRulez Computer screens emit light. – Stuntddude Jan 19 '16 at 4:59
  • 8
    Not to mention, the vibration of the keystrokes themselves can actually give away the keys typed... using any nearby smartphone with an accelerometer... or the accelerometer in the computer itself which is there to protect the hard drive.... See cc.gatech.edu/fac/traynor/papers/traynor-ccs11.pdf – Dan Jan 20 '16 at 6:08
  • 14
    This seems like more of a "life-hack" answer - I can't imagine that this would seriously be considered "normal" for a manager to do in front of co-workers. – DoubleDouble Jan 21 '16 at 20:48
178

You could use Two Factor Authentication that uses your phone to log in along with your password. That way, even if they see your password, they would need your phone, too to log in.

125

Get a password manager like KeePass and store your password there. Use the auto-type or a plugin to enter the password.

  • Unlock your KeePass database when you boot your machine, so that you don't have to unlock it with people around.
  • Set it up so that it locks automatically when you lock the screen (just in case)

Alternatively, you can remember the e-mail password in your browser, which has downsides compared to KeePass but will keep your password save (given enough scrutiny).

  • 7
    I have been using keepass and it works great. it is even available in portable form so you can carry it usb. this way it will never be stored in office. – neogeomat Jan 15 '16 at 12:17
  • 9
    Keep in mind that passwords stored in your browser can be trivially accessed by another person using that browser (or computer, if he/she is an administrator). – WillS Jan 16 '16 at 0:54
  • 3
    Sure, but now your employer can get at your passwords. They might have to read the raw RAM of the machine and dig around to find them, but it's their machine; they can do that… – Blacklight Shining Jan 16 '16 at 4:14
  • 34
    Physical access beats all defences. If I can tamper with your machine, I can just as well replace your KeePass installation with a fake that will send all the passwords to me once you decrypt the db. Bottom line: If you want to log in to your private e-mail on your employer's machine, you HAVE to trust the employer – Kos Jan 16 '16 at 20:15
  • 4
    KeePass can use any combination of a typed password, file or Windows account as part of its unlocking mechanism. Since OP is primarily worried about shoulder surfing, a file on a USB stick would be sufficient. OP would never need to type in any passwords other than for their computer's login. – Shaz Jan 20 '16 at 16:14
60

While I recommend two-factor authentication on your personal account, you could set up second, work only account (as others have suggested), set up an automatic forwarding rule to it for the emails that are work related, and then log into that when necessary.

This way, you don't need to have your professional contacts update your email address, and you're only logging into an account with non-personal emails.

45

My email service is end to end encryption,

Unfortunately, when logging from an untrusted computer (your company's here) this does not mean much:

  • The company may have installed the company's certificate in the trusted root of the browser you use and be proxying all the traffic through a server which essentially performs a MitM attack.
  • The company may be observing the programs' memory, logging your keystrokes, ...

which means it does not store password or reset password.

You should be able to reset your password, end-to-end encryption does not preclude resetting passwords. Select an e-mail provider/technology which allows it.

On the other hand, if you operate from an unstrusted computer, password-protecting a private key is not as effective: since the company may access any program's memory, they may access your private key after it's decoded with your password.

I can't shift the screen.

If you are worried about your team members seeing your e-mails, then you might want to bring this point to your boss; especially if they are used to send you confidential e-mails (such as discussing the performance of some of your team members, or other personal information).

However, this should have no impact on your passwords: it should never appear on screen.


In light of the fact that your company may very well be "spying" on you, and possibly legally so depending on your jurisdiction:

  • use a work-only e-mail account (do not leak your personal mails/discussions to your company)
  • use a work-only password (do not leak your preferred password to your company)

If you wish to secure said e-mail account (to prevent others from perusing your e-mails or sending them in your behalf):

  • rotate your password regularly
  • use two-factor authentication, if available
  • 7
    preferred password is a strange thing, one should not use same password for more than one service – Sarge Borsch Jan 15 '16 at 12:48
  • 2
    @SargeBorsch: That's the theory, as we all know, unfortunately, password reuse is a thing. – Matthieu M. Jan 15 '16 at 13:30
  • 12
    At the very very least, have one password for personal stuff, and a separate one for work stuff. And a separate one for non-reputable services likely to be hacked and throwaway accounts. And…actually, just get a password manager… – Blacklight Shining Jan 16 '16 at 4:17
43

You should assume your employer has access to your keystrokes, so even if you do make them look away, it won't help at all. If you still insist on this false sense of security, you should become one with the tinfoil like Edward Snowden.

Schroeder and Neil have given two very good alternatives:

  1. Create a new junk email account for work.
  2. Use Two-Factor Authentication.

You could even use both 1 and 2.

  • 7
    Both? You can't ignore this possibility, as it may be quite likely. – Mark Buffalo Jan 15 '16 at 4:41
  • 2
    "You should assume your employer has access to your keystrokes, so even if you do make them look away, it won't help at all." -- it doesn't follow that it doesn't help at all. Just because some colleague has physical access to install a keylogger (USB or otherwise), doesn't mean they will actually weigh up the risks and cost of making that attack, and the risks and cost of shoulder-surfing, and find them to be the same. So preventing the easiest attack actually can help a bit. You just don't know whether it will or not unless you know how motivated your colleagues are to get your password. – Steve Jessop Jan 19 '16 at 11:33
  • 3
    I'm talking about employers, and managers. In the IT industry, whether you realize it or not, managers "manage" people, and they generally have access to whatever it is that you're doing - including your keystrokes. They just don't tell you about it. – Mark Buffalo Jan 19 '16 at 11:47
  • 2
    @Scott Yeah, but OP may be unaware that management can easily keylog him. – Mark Buffalo Jan 20 '16 at 11:23
  • 3
    @Scott I feel you may be missing the point. I don't agree with letting someone start with a false sense of security. Part of this website is about offering different perspectives, and there may be things people haven't considered before. If the OP is worried about his password being stolen, then it follows that he should know that many employers keylog you. – Mark Buffalo Jan 20 '16 at 17:12
17

Simple. Setup your separate work email. After that setup an auto-forwarding from your personal mail to your new-work-email, for senders who don't know your new email yet and then you can be confident logging that email account in front of your colleagues.

hope it helps! :)

  • 1
    +1 was just about to suggest this. Create another email account that you only use for work and hence don't care if your partners see or even use it. Using your personal email as an official part of your job is a problem just waiting to happen, regardless of this particular question. – Wayne Jan 16 '16 at 0:57
  • 2
    DO NOT DO THAT. If you set up forwarding, compromising your work e-mail means getting full access to all accounts linked to the personal one, using the "I forgot the password" feature. – d33tah Jan 22 '16 at 19:24
  • 3
    @d33tah, you could just forward e-mails based on filters, e.g. coming from known senders or specific keywords. That way you won't forward those such ones that help you reset the password of the original account. – Stefan Marinov Feb 6 '16 at 21:22
13

A YubiKey is capable of storing a fixed string that can be activated. Make your password a combination of the a random character string that is on the YubiKey and your typed password. It's not quite two factor authentication, but it does mean shoulder surfing the keyboard alone won't be enough to get your password.

If you use GMail, they integrate with U2F and TOTP generators, in which case you can actually use proper 2 factor authentication.

  • 5
    This still leaves you open to a keylogger installed on the machine, though. – Blacklight Shining Jan 16 '16 at 4:18
  • 6
    @BlacklightShining Physical access defeats any measure you can take. If you can't trust the machine, there's no way to authenticate yourself to the email service or trust anything. – Martijn Heemels Jan 20 '16 at 10:20
  • @BlacklightShining A passive keylogger will not break U2F because it uses public key crypto. – Navin Jan 21 '16 at 22:39
10

Buy a simple fingerprint scanner or use a laptop with fingerprint scanner (pretty common now a days), then use a password manager to store your password for that email service and login with a swipe of your finger.

I do that all the time with HP Client Security.

And that looks more hi-tech than awkward like many other solutions do in front of other people :)

  • 2
    A fingerprint is not a password, at best it's a user id. You leave it behind on almost everything you touch, and how can you change your "password" finger in the future? New fingers? – Xen2050 Jan 21 '16 at 3:12
  • Probably have not used that feature ever?. Niether did i mean it is a password nor does grabbing a fingerprint from somewhere else works fine on a computer fingerprint swipe scanner in real life. You can change password anytime you want and your password manager will know the new password if you tell it. – Hanky Panky Jan 21 '16 at 5:14
  • 3
    And in an office if other people are so determined to snatch your password that they will take your fingerprints from the door knob and then generate a mold and then login to your computer then you might not as well be there in the first place looking for an answer to this question. Wouldn't such people easily take off the blanket off your head like suggested in the top answer? – Hanky Panky Jan 21 '16 at 5:16
  • 1
    The question reads How should I securely type a password in front of a lot of people? and not How do I protect my password from a lot of hostile spies in my office? – Hanky Panky Jan 22 '16 at 7:17
  • 2
    I upvoted this answer because as an I.T. guy, I frequently have people over at my desk. It's very convenient to just swipe my finger to unlock the computer. You don't want people to see what keys you are typing on your keyboard, but you also don't want to make them feel like you don't trust them. The fingerprint reader is awesome. – Quixrick Jan 22 '16 at 15:37
9

You could always learn to use the Dvorak Keyboard Layout! You will rarely encounter anyone watching over your shoulder familiar with this layout. I use it and I've never encountered anyone who could tell what I was typing even if I slowly pecked away with my index finger one key at a time.

  • 3
    But if you look at what you type and type it again, I'll use your password even if the keyboard layout is different. – A.L Jan 17 '16 at 2:09
  • 21
    this is the "lucky charms decoder ring" level of security. – djechlin Jan 18 '16 at 3:10
  • Even if the don't get it by looking directly they could use a camera and decipher afterwards. – Christian Jan 18 '16 at 11:28
  • better yet, make your own. that's what I did... – user530873 Jan 25 '16 at 6:59
7

You can use AutoHotKey and replace the full or parts of the password automatically while typing. I was using this method before I switched to KeePass and used Auto-Type.

::pop::part0fP4$$w0rD

That way, users seeing you type will only know parts of the password, not the full password. Disadvantage: the second half of the password is stored in a file. To mitigate that a bit, I made the replacement longer than needed and delete a few characters using backspace.

7

When I enter a PIN code in a grocery store, I fake a few extra key-presses between the real ones, by putting my finger on the key but not pushing it. It's especially convenient when the keys don't visibly move much (as in the case of almost all keypads I've encountered on card scanners and ATMs), but with some practice it can be done with a standard computer keyboard.

It doesn't help against people who are trained and dedicated to spy on you, or use a camera and watch it later in slow motion, but it provides a good protection against casual glances.

  • If you are touch typing a fake hit on a bottom row key should be basically impossible for an observer to detect unless they can also note that no * appeared in the password box when you "hit" that key. – Loren Pechtel Jan 22 '16 at 22:41
3

If you want to visually block shoulder-surfers but don't want to go full blanket-over-head-and-PC for the obvious appearance downsides, you could get a similar level of protection with less awkwardness by putting a smaller cloth over just your hands while you touch-type your password. Still awkward, but not as glaringly so. A password manager plus MFA is still generally the best choice in this scenario.

  • 4
    I'd appreciate if the downvoter/delete voter(s) would explain why they think this is both a bad answer and an invalid answer instead of just throwing a delete request at it. – pydsigner Jan 19 '16 at 23:56
3

No blankets over your head required - just cover up a small section of the keyboard with your other hand, while typing in your password.

This would work excellent if you had all the letters on one side of the keyboard, or a numbers-only password, and have a number pad on the keyboard to type it in with. Very much like you're supposed to do at an ATM machine.

Like this photo too, (only do a better job ;-) enter image description here

All the caveats about your employer or company being able to monitor every keystroke and all network traffic apply, but this will keep prying eyes off at least.

2

As others have said, anyone in your office can just either install software on your PC, or plug in a physical keylogger between your PC and your keyboard. Of the solutions mentioned so far, only 2 factor authentication provides reasonable defense against physical access. But tampering with a computer to find somebody else's password is a criminal offence in many places and will also get people fired if caught, so the chance that they will do that is significantly lower than them just looking at your keyboard while you type.

Of the solutions mentioned so far, only 2 factor authentication provides reasonable defense against physical access.

The one solution which is missing is: BYOD. Bring in your own laptop, tablet or phone to access your email. That device uses an email client that has already stored your password, and the device requires a pin, fingerprint, or eye reading to unlock.

2

My proposal requires support on the server. If your service provider does provide this service (or if they are willing to), this doesn't actually answer the direct question (how to prevent the passphrase from being seen) but actually addresses the problem that most people try to solve (which is how to authenticate without revealing details that allows someone else to authenticate). The secret is to...

Don't worry if they get your password.

There is technology called OTP (One-Time Password), such as the S/Key implementation, which allows you to type in a password onto a trusted device. The trusted device uses some software, such as skeyinit (on Unix-like platforms -- skyinit man page) or OTPDroid (an open source option on Android platform) to generate a series of words. Then, you don't need to care if anyone thinks they saw your typed password, or even if there is a keyboard logger, because that series of words is only valid once.

If you can't type on your phone safely, another option (if you have foresight) is to generate the list of words ahead of time, and store them somewhere (maybe even using pen and paper). Then you can look at the pre-generated note that reminds you what words will need to be typed.

2

Snce you are asking..

1) shroud the keyboard. Learn to type blindly, accordion style.

2) implement opie style single use passwords.

3) login using keypairs via an ssh tunnel or similar.

4) try really hard not to mumble the password audibly as you type.

5) periodically scan for ultrasonic modem noise, unusual RF activity.

6) be acuteley aware of reflective surfaces, mirrors, glass.

7) DO NOT type it into unmasked fields accidentally.

8) Momentarily re-map your keyboard.

9) or just don't do it in public. etc. etc.

1

Ask your co-workers politely to turn around for a second. In a working environment nobody should be surprised or complain.

  • Any work environment people should not wonder if you ask them not to spot on the keyboard while one enters credentials... – user98946 Feb 2 '16 at 20:13
1

I am a manager in an office where the company does not provide a company email, so I use my personal email.

I agree with one of the comments: Create your own work email account in a place like gmail or on your own shared hosting web site if you have one. It is probably more important that managers have communications distinct from their existing personal accounts.

Often, I will receive jobs lists by email from my general manager.

Perhaps you could bring the point up to the General Manager that your work space is not conducive to the privacy of her or his emails to you, depending on the strength and candidness in that relationship.

How should I log in to my email in front of my co-workers so that they don't see my password?

There are several options you can use with a new account. Some of them might work in tandem.

  1. You can store your password in the browser early in the morning.
  2. You can make the characters not echo, depending on the mail client. (Be aware that this should definitely be in place for your operating system log-in.)
  3. You can use very strong passwords and learn to type them at high speed.
  4. You can say, "Please turn around," which is certainly appropriate under the circumstances.

My email service uses end to end encryption, which means that it does not store or reset my password.

It is good that your service uses client side encryption (if that is what you mean by end to end encryption). Perhaps that is not a necessary security measure for a company that does not have its own email server. If it is necessary, you could encrypt the data on the computer and send the ciphertext as an attachment.

I also cannot move the screen so my co-workers cannot see it.

It is best, in today's corporate environment, to assume that sustained privacy of display contents is not a realistic option.

I cannot speak for Windows or iOS, but with a properly configured SE LINUX system, the security level is high enough so that I can store all my passwords in such a way that I never have to type them during the workday. Then I start work, typing the single LINUX account password (which does not echo to the display), before anyone else starts theirs.

-2

Get yourself a cheap barcode scanner, attach it to your computer and configure it as a "keyboard wedge" so it pretends it is a simple keyboard.

enter image description here

Print your password as a barcode (there are many free barcode fonts around) and stick that in a pocketbook you carry on your person.

Whenever you need to log-in, reach out your book, open it, scan the barcode and close the book.

  • 10
    But then, surely anyone who simply has a camera-enabled phone in your vicinity can silently snap a picture and then decode your password at their convenience? – This isn't my real name Jan 18 '16 at 22:42
  • 2
    @Thisisn'tmyrealname Yes. :) The crux is whether your staff would do this. Your call. – OldCurmudgeon Jan 19 '16 at 0:33
  • 6
    But doesn't the fact of the question itself imply an environment where you would have to be concerned about this? – This isn't my real name Jan 19 '16 at 3:53
  • 5
    Instead of this, I'd suggest programming a Yubikey with a static random string. The Yubikey simply emulates a keyboard. Append the string to the password you have memorized. When you need to enter your password, first type the part from memory, then insert the Yubikey into a USB slot and touch the button. It will enter the static string to complete the full password and hit enter. A key is easier to keep on your person and less obvious than scanning a barcode. Here's a tutorial: yubico.com/products/services-software/personalization-tools/… – Martijn Heemels Jan 20 '16 at 10:28
  • This just leaves the book as a security weakness. This can be partially overcome by having multiple barcodes, you scan a few to build up your password. The keyspace you can reasonably make this way is too small for real security but anti-flood measures should make it not work very well. – Loren Pechtel Jan 22 '16 at 22:44

protected by Community Jan 15 '16 at 20:36

Thank you for your interest in this question. Because it has attracted low-quality or spam answers that had to be removed, posting an answer now requires 10 reputation on this site (the association bonus does not count).

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.