3 ms·

2 comments: 1) This needs a [2014] tag. 2) This encourages password re-use and the 2019 guidance really needs to focus on generating unique passwords for each

2 comments: 1) This needs a [2014] tag. 2) This encourages password re-use and the 2019 guidance really needs to focus on generating unique passwords for each site / property and storing it somewhere secure. The push to move to other forms of security has never been stronger.

plibither8 7y ago
Just wondering, how does this encourage password re-use?
- jlmb 7y ago
  When using a password manager you don't need to ”check the input” or “correct an error” or “see what characters have been typed" (the only ”usability problems” mentioned in the article)
- ekzy 7y ago
  I think OP mean that if you use unique passwords, you would typically use a password manager and randomly generated passwords. You don't need to know so there is no point in seeing the password. I don't think showing the password would actually encourage to re-use a password, but hiding the password may encourage to use a password manager and unique passwords.
abathur 7y ago
I see the logic in point 2 and agree it's possible that this could be the net effect, but I think there's at least one more distinct possibility. I use a good password manager with long, unique, random passwords. The world is messy, though, and some small fraction of the apps/sites/devices/contexts I need to enter credentials stored in my password manager require manual entry. Some of these are on a device with the password manager, but fail to support auto-fill and block paste. Some of these are on other devices (such as TV streaming boxes). It also applies to every login I need to enter on a new device before my password manager is installed and unlocked. When I have to enter dozens of high-entropy characters on mobile keyboards, TV remotes, or my sad 3rd-gen MacBook butterfly keyboard, a simple unmasking toggle is a lifesaver. Its absence is a misery/frustration multiplier. I'm not sure how the initial login on an iPhone is, but it took me 4 tries to log in on my newest Android because I had to enter ~40 characters while swapping between the stock alpha/symbol keyboards without an unmask. I'm sold on the value of using a password manager and aware of the risks of not doing it, so these frictions won't deter me. But I'd be surprised if I'm in the majority, here. I suspect many people will fail into partial or complete non-compliance with the password manager if they regularly encounter these scenarios (or encounter them while the costs of abandoning the effort are still minimal).
larrik 7y ago
Password managers sound great until you buy your kids a Chromebook and they need to type in their secure password to log in every damn time.

plibither8 7y ago

Just wondering, how does this encourage password re-use?

jlmb 7y ago
When using a password manager you don't need to ”check the input” or “correct an error” or “see what characters have been typed" (the only ”usability problems” mentioned in the article)
ekzy 7y ago
I think OP mean that if you use unique passwords, you would typically use a password manager and randomly generated passwords. You don't need to know so there is no point in seeing the password. I don't think showing the password would actually encourage to re-use a password, but hiding the password may encourage to use a password manager and unique passwords.

abathur 7y ago

I see the logic in point 2 and agree it's possible that this could be the net effect, but I think there's at least one more distinct possibility. I use a good password manager with long, unique, random passwords. The world is messy, though, and some small fraction of the apps/sites/devices/contexts I need to enter credentials stored in my password manager require manual entry. Some of these are on a device with the password manager, but fail to support auto-fill and block paste. Some of these are on other devices (such as TV streaming boxes). It also applies to every login I need to enter on a new device before my password manager is installed and unlocked. When I have to enter dozens of high-entropy characters on mobile keyboards, TV remotes, or my sad 3rd-gen MacBook butterfly keyboard, a simple unmasking toggle is a lifesaver. Its absence is a misery/frustration multiplier. I'm not sure how the initial login on an iPhone is, but it took me 4 tries to log in on my newest Android because I had to enter ~40 characters while swapping between the stock alpha/symbol keyboards without an unmask. I'm sold on the value of using a password manager and aware of the risks of not doing it, so these frictions won't deter me. But I'd be surprised if I'm in the majority, here. I suspect many people will fail into partial or complete non-compliance with the password manager if they regularly encounter these scenarios (or encounter them while the costs of abandoning the effort are still minimal).

larrik 7y ago

Password managers sound great until you buy your kids a Chromebook and they need to type in their secure password to log in every damn time.