0

This question already has an answer here:

The two most common behaviors I see in password entry fields are:

  • For each character typed display an asterisk in the password entry field.
  • Display nothing at all in the entry field.

The approach of displaying nothing at all in the entry field can be a risk because it means if focus is somewhere else, the user may unknowingly type their password in a place where it shouldn't have been.

I know displaying the asterisk characters makes it easier for a shoulder surfer to figure out how long a password you are using. But to me that sounds like a very weak argument. If the password is short enough for that to matter it would be weak even if the adversary doesn't know the length of the password.

Are there any other security arguments in favor of having no feedback in the password entry field?

marked as duplicate by Sjoerd, Arminius, Steffen Ullrich, kasperd, Community Jul 23 '17 at 22:16

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

  • backspace is a key, and you can use it in passwords to alter the length or provide memorableness – dandavis Jul 23 '17 at 22:18
  • @dandavis Sure one can memorize a sequence of key presses involving a backspace in order to fool anybody observing you typing the password into thinking the password is longer than it really is. But it would be pretty pointless. Removing the backspace and the previous character is a shorter sequence that would also be accepted, and that is going to be the one which the adversary will find. Rather than memorizing a sequence of keys you could memorize a different character in place of the backspace which is both easier to type and more secure. – kasperd Jul 23 '17 at 22:24
0

No, there is no good reason to hide password length and if this is done then it's usually for other reasons like it being easier to implement.

It is bad user experience and a shoulder surfer can pretty easily count keystrokes.

Not the answer you're looking for? Browse other questions tagged or ask your own question.