Is a password box with pseudo-random number of stars more secure?

Question

I use a program that confused me while typing the password. It acts like this when I type the password ABC:

I type: A Display: ***

I type: B Display: *****

I type: C Display: **

I can think of the idea behind that: anyone looking over my shoulders may not be able to get my actual password length.

On the other hand, I was confused because I thought something's wrong with my keyboard. Now I'm used to it.

The stars don't seem to be completely random. It depends on the character typed, so that typing ABC always results in the same amount of stars. Using different characters also changes the number of stars. After a few days you'll be confident entering the password, because you can see how the stars change in a consistent way.

I would agree that real randomness contributes to security. But how about this pseudo-randomness? Wouldn't someone with access to the application (e.g. just buy a license) be able to figure out the length anyway?

Answer 1

Someone watching you can often hear how many keys you've typed already (or can count the number of times the typing indicator changes), so the standard model of showing a star for each character doesn't really leak anything new. By changing the text field from that to making it based on some other quality related to the password, you're just leaking that new quality in addition to the length. If an attacker knows the password is 10 characters long, shows 8 stars, and knows your software's algorithm, that tells them even more about the password. What if your algorithm is found out to only show 8 stars for a single 10 character password?

Maybe the above is an extreme example, but consider that this system also leaks info about all of the partially typed forms of the password. If the password is "abcd", then when the user types "a" first, then some number of stars will be shown, and this will tell the attacker about the first character. Maybe "a" causes 3 stars to be shown right off the bat, and the attacker knows that only "a", "g", and "x" do that. Next, "ab" is typed, and that shows 1 star. The attacker can then figure out of all of the possible two-letter sequences that start with "a", "g", and "x" that result in 1 star. The attacker can then cut these down further by throwing away a lot of the sequences that they think are unlikely to be at the start of a password. The attacker might see that "ab", "am", "gq", "ge", "xc" are the possible two-letter sequences, and then throw out or de-prioritize "gq" and "xc" as possibilities for the start. Next, "abc" is typed, and that shows 4 stars, and the attacker only has to consider the possible three-letter sequences that start with "ab", "am", or "ge" that result in 4 stars. Repeat this a few times, and the attacker might not be down to one possibility for the password, but the search space is massively cut down.

If you want a system that is sure to leak less information than the standard show-characters-as-asterisks prompt, then you could copy a convention often used in terminal password prompts: don't move the cursor or change the screen at all while the user types their password. This does confuse some users though.

Answer 2

It is theoretically better for your security if an onlooker cannot see how many characters you've typed. However, this implementation of it is not a good one. The reason that stars (or asterisks) are used is to give the user feedback that they are typing, and randomising the number of asterisks that appear will confuse the user because it appears to suggest that their typing is not working correctly.

(And if the number of stars is not random but depends on which letter was typed, this is worse, for the reason given in the other answer.)

So, it would be better to think of some other type of user interface that won't confuse the user, will give them feedback that they are typing, and won't reveal the number of characters typed to an onlooker or worse, narrow down which characters were typed.

Perhaps a spinner or throbber that spins while you're typing and stops 400ms after you stop typing. But that is just a spitball idea. Any user interface that the user is not used to has the risk of confusing the user.