2

Why does the password field not show the entered text?

When we enter password it shows ... or '*'.

What are the security advantages of this?

Improve this question

6 Answers 6

Reset to default
7

The primary concern is to prevent "shoulder surfing", where a user is in a position where someone else may see their screen as they enter a password. You don't want users to be forced to secure their visual surroundings before entering a password, as that may not be plausible for them. It isn't always necessary, but it's a good practice.

There is some detailed analysis on the pros and cons of this practice here. (Note the many links to follow.)

Improve this answer
1
  • 1
    Cannot count the number of times I've shoulder-surfed people's details. Never used them of course, but be aware of your damn surroundings people!
    – Polynomial
    Aug 10, 2012 at 6:01
3

Primarily, this is to prevent shoulder surfing.

While shoulder surfing is generally thought of being done in-person by someone literally looking over your shoulder, there's also the possibility of it being caught under video or photographic surveillance. This surveillance may even be authorized, as a security measure in your environment. However, the viewer's knowledge of your password would likely not be.

Granted, someone could still gather your password from watching your fingers carefully. However, it is much easier and less conspicuous to read a screen than it is to closely observe and note or memorize the motions of your fingers. Video surveillance is also often done at an angle which is not that great for recording finger movements.

Another thing this protects you from is screen capturing malware. However, this is minimal since any malware capable of reading your screen should also be presumed capable of having access to your keystrokes.

Improve this answer
3

Finally a good question. There are two main advantages.

First, you know that what you're doing is different from entering other fields containing less sensitive data, you are entering a password, which by design should be kept secret. Dots or stars (before Windows XP) suggest this.

Second, if someone is standing next to you and looking at the display, they could see the password. I've also seen systems where you enter a password and each character is shown as three X's. You press H on the keyboard and it shows XXX in the password prompt. You enter HAKC and it shows as XXXXXXXXXXXX. This makes it harder for someone to know how long the password is.

Improve this answer
1
  • Lotus Notes (don't laugh) is an example of an app that displays a random number of X's when you type your password to, as Matrix says, obfuscate its true length.
    – queso
    Aug 9, 2012 at 21:08
1

It's so that people watching your screen can't see the password as you type it.

Most of the time this isn't an issue but in the rare times where it matters it's very important.

Improve this answer
1

Shoulder Surfers can't see your password when they stand behind you.

Improve this answer
-4

The security advantages of this is that you can see the number of letters in the password, thereby greatly reducing the attack space.

Improve this answer
1
  • 3
    Actually, that's a security dis-advantage.
    – Iszi
    Aug 9, 2012 at 21:13

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .