I just read this article about unmasking passwords at sign up for usability reasons. On the surface it seems reasonable to me, but I'm wondering what additional security concerns that might generate, if any.
Masking password fields is designed to prevent shoulder-surfing, where an attacker watches you type in a password. Unmasking is a bad idea in public, but it's not so bad in signup scenarios when the user is alone in the room. Whilst I personally disagree with the assertion that users are incapable of typing in a password correctly twice in succession, I'll go along with it for the purpose of this question.
I think the security concerns are covered quite well in some of the comments.
Luca Rosaldi said:
Another good approach (IMHO) would be including the “show password” checkbox, but checked by default. This way, if I’m alone I could check my password without concerns for security, or if I’m not I could uncheck the box and type my password.
To which Ray McCord replied:
It should be exactly the opposite.
It must be masked by default and the user must have to take an explicit action to unmask it — and even then that choice should be honored only very temporarily before reverting to masked.
Because this password form is acting as your agent and it, therefore, must be made to act in your best interest first — like a bodyguard.
This is a decent compromise - the default is to provide the user with the maximum possible security. If the user decides that it's just too damn hard to put their password in correctly, they can opt to sacrifice security for usability. This has the extra benefit of not patronising users that are perfectly capable of typing properly.
The biggest problem isn't really a security one, but rather a confidence one. Tesmond put it perfectly:
Simply displaying the password field is very uncommon behaviour, it instantly creates cognitive dissonance and perhaps even instant panic as your “secret” password is displayed for all on lookers. You may worry that your password will be visible in all places within the application and may even make you change your password to a less memorable one.
This actually creates a security problem. If you saw your password appear unmasked, you'd be a little confused as to why the site decided to buck the trend. Perhaps they don't care about security? Perhaps they store it in plaintext?! Perhaps your password will be visible on every screen!!? The user will then pick a terrible password that they don't care about having compromised, which puts their account at risk.
To be honest I'd say that the article, in combination with the comments on it cover most of the likely security concerns.
As stated the usual security concern for displaying passwords is a "shoulder-surfing" attack where someone can overlook a user and thereby get unauthorised access to their password.
Obviously this risk is only present in environments where the user can be overlooked (e.g. offices, coffee shops, etc).
I'd largely agree with the opinion expressed by some of the commenters that there's a balance to be had here between security and usuability. I'd say that an approach which requires the user to actively uncover the password (and which only works temporarily) is a reasonable trade-off. this could be similar to the windows 8 approach where an icon on the password field can be clicked to reveal the password, but the password is only shown so long as the user holds down the mouse button over that icon.
The main concern is people snooping over the shoulder, as the article correctly states. In theory, the only difference, when using password masking, is the way the password gets displayed to the user, other than that, on the software level should be is no real difference. However, if the browser doesn't know that a field contains a password or other sensitive data it might behave differently, for example storing the password in a non secure way, as part of the forms auto-fill feature.