23

I realize that the concept behind obscuring a password on a screen is to prevent someone "shoulder surfing" behind a user and seeing the typed in password. As a fairly good typist I have no problems with dealing with this, but this causes a lot of pain for people I know who are very slow typists: (Dilbert strip) my keyboard is broken

Can't we just assume that people entering a password are checking to see if anyone is trying to look at their screen before they enter a password? Or is there some other reason for obscuring a screen password?

Improve this question
20
  • 11
    It's worth noting that password fields recently have started providing a "preview" button, typically in the field itself, which shows the password as plain text.
    – William
    Jun 2, 2016 at 11:51
  • 40
    "C'mon guys, let's all gather around the computer and look at this presentation, but let me log in first so could you please all turn around?"
    – iAdjunct
    Jun 2, 2016 at 12:53
  • 17
    @iAdjunct: I agree the presentation issue is a problem. On the other hand, it requires a technically clueless presenter (unable to turn off the display). How often could that possibly happen in modern corporate....I withdraw my objection.
    – Mark Ripley
    Jun 2, 2016 at 13:05
  • 7
    @MarkRipley even with a reasonably technically competent presenter, the delay in turning off the display, waiting for the resolution to adjust, turning it back on, and waiting for the resolution again can really kill the momentum of a presentation - particularly when you have to log in multiple times within one presentation (e.g. logging into multiple different internal tools - a regular occurence where I work.)
    – Tin Wizard
    Jun 2, 2016 at 18:13
  • 3
    This isn't a duplicate? Odd. I fail to see how typing speed is remotely relevant to having to remember what characters you've already typed, could you elaborate on that?
    – Mast
    Jun 2, 2016 at 19:36

3 Answers 3

Reset to default
37

The primary protection provided by password masking is against shoulder surfing, as you suggest. Typing speeds are a factor, but a reality is that screens could be captured by video recording devices as well (which exposes passwords to typed on mobile phones, where each character is visible for a few hundred milliseconds before being masked). As the exact environment around a user is not known, it makes sense to have a default masked view, with an option to preview as suggested by @William Mariager. This is also true in case of shared screens, projectors... Some simplistic malicious software do perform periodic image/video screengrabs, which is also defended by password masking.

Hence we can't assume that people can always check to see if their screen is obscured.

But, another reason for doing this now is historical-- users are now so used to seeing masked passwords that websites using unmasked passwords are perceived to be insecure (Source). The masking also informs all users that the information being entered is sensitive.

Also read: Schneier about password masking

Studies that argue against password masking: [1][2]

Improve this answer
10
  • 1
    I like your links about this. The "historical argument" for password obscuring reminds me of the question here: security.stackexchange.com/questions/4704/… where one conclusion was that forced password changes every 90 days is partially caused by regulators clueless about security.
    – Mark Ripley
    Jun 2, 2016 at 13:00
  • Personally I think the "typed-char-being-visible-for-a-split-second" feature (which seems to be popular with Mac devices) is actually horrible. I have seen several (recorded) live presentations where the presenter inadvertently published one of their passwords that way.
    – fgysin
    Jun 2, 2016 at 13:57
  • 2
    @Jedi My assumption is that it is due to the lack of tactile feedback when using an on-screen keyboard, meaning you're more likely to hit the wrong button by accident and not realize it until you've typed out the whole password and it fails to validate. That's been my experience, at least; on physical keyboards, I only have issues when I type too fast, while I have a much higher rate of typos on touchscreens due to the lack of tactile feedback.
    – JAB
    Jun 2, 2016 at 17:27
  • 2
    It's amusing how people perceive this as secure when all it takes to uncover the password you just entered is to change the "type" of the input field from "password" to "text".
    – Gigala
    Jun 3, 2016 at 10:28
  • 2
    I agree with the idea that (my addendum: stupid) users see ****** fields as more secure. I once had an entirely personal-use website, no legitimate concerns about other people seeing your password, and received at least 2 complaints I was trying to steal people's passwords because it displayed the text instead of *****. Which of course told me that if I was to steal their password, it'd probably work on other sites, else they wouldn't care if I, the system admin, had it.
    – user83389
    Jun 3, 2016 at 16:58
21

Can't we just assume that people entering a password are checking to see if anyone is trying to look at their screen before they enter a password?

In May 2008 Schneier cited a research paper Compromising Reflections or How to Read LCD Monitors Around the Corner claiming:

All it took was a $500 telescope trained on a reflective object in front of the monitor. For example, a teapot yielded readable images of 12 point Word documents from a distance of 5 meters (16 feet). From 10 meters, they were able to read 18 point fonts. With a $27,500 Dobson telescope, they could get the same quality of images at 30 meters.

8 years later, with both camera resolution and screen quality increased, you cannot assume any environment to be safe just because there is no human present.

Improve this answer
8
  • 1
    This information is impressive. And the same methods can't see which letters a user types on his keyboard because?
    – Mark Ripley
    Jun 2, 2016 at 12:39
  • 1
    In my opinion it is orders of magnitude more difficult. If someone looks at the computer screen wearing glasses with reflective coating you can see a screen reflection with a naked eye. You won't see their keyboard reflection.
    – techraf
    Jun 2, 2016 at 12:58
  • 3
    For completeness, found the source. I suppose apart from telescopes observing screens, you would also worry about acoustic sniffing or smartphone motion-based attacks. Which brings you full circle to OP's POV- stop using passwords alone as an authentication system
    – Jedi
    Jun 2, 2016 at 16:56
  • 3
    Here are a couple more sources. It's possible to capture images off of the eye itself and things like plastic soda bottles. infsec.cs.uni-saarland.de/projects/reflections mia.uni-saarland.de/Publications/backes-sp09.pdf
    – JimmyJames
    Jun 2, 2016 at 21:07
  • 1
    @MarkRipley just buy bhphotovideo.com/bnh/controller/… it is a bag photographers use to handle film outside without a dark room. Put your laptop in the black bag and type the password. Do note the people around you can observe your shoulder muscles and make inferences about which keys you are pressing. Better just get a photographic dark room.
    – emory
    Jun 2, 2016 at 23:11
6

Can't we just assume that people entering a password are checking to see if anyone is trying to look at their screen before they enter a password?

It's not that simple, for a number of reasons.

You might be in a public location, where there are too many other people around for you to monitor. Don't forget that you don't have eyes in the back of your head.

You might be in the presence of people you don't trust, but for social reasons you do not want to, or are not supposed to, act outwardly distrustful (such as covering the screen with your hand, or asking them to turn around). They might even be close friends, family, or co-workers, or people you're in a conversation with. It's not always convenient to relocate yourself.

You might be in the presence of people with good vision and memory, who might accidentally see parts of your password.

So no, you might not notice everyone who might look at your screen. No, you might not know if they're looking or not. No, you might not be in a social position to stop them from looking. And no, it's not only the "bad actors" you need to worry about—anyone could mistakenly catch a glimpse. So it's convenient for the default to be safe against shoulder surfing. It can be nice when a program gives you the option to display the password visually, but all features take work to implement. It's important to have, at a minimum, the mode where the password is invisible. And it's better to have that as the default.

Improve this answer
1
  • 3
    people with good vision and memory yep... try to intentionally forget something and see how easy that is to do.
    – Dan Henderson
    Jun 2, 2016 at 21:21

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .