6 ms·

Aside, I've noticed that the current technique of rendering a fixed number of asterisks independent of the password length is quite confusing to users -- "that'

Aside, I've noticed that the current technique of rendering a fixed number of asterisks independent of the password length is quite confusing to users -- "that's wrong, it's the wrong length", resulting in attempts to type in the "correct" password and this obviating the benefit of the stored password. Not sure how to fix that. I recall a visible hash of some form being used in the past (eg take a 2-digit hash, pair of with a smiley; I must have entered it right, it's showing me ROFL smiley), but that would aid shoulder surfed password entries, at least.

letsdothisagain 3y ago
I'm honestly seeing little value in asterisks with WFH and the move to passphrases. Feedback is important when you're typing a long phrase with complete precision. Plus shoulder surfing is simply not a thing when my physical security profile now involves a locked front door and a call to the police.
- iknowstuff 3y ago
  Are you describing your experience or implying that the industry should change this because you can WFH?
  - froggit 3y ago
    The latter. They seemingly meant "I can WFH, so asterisks are meaningless to everyone. F@&# asterisks!"
- autoexec 3y ago
  WFH also means Working From my backyard, the coffee shop around the corner, the library, a friend's house, a hotel room, etc. Even for people who only work at home while working remotely, private homes can see a lot of traffic. I wouldn't assume all screens are kept and used in totally secure environments so we should probably still stick with masked passwords and telling users not to keep passwords written on a post-it note stuck to their monitor.
  - deleted 3y ago
    [deleted]
  - aeternum 3y ago
    And now employees simply leave their laptop open with the SSH window up while getting their coffee because it's now so annoying to close the lid and correctly type the password. >USB Rubber Ducky has entered the chat
  - matt-attack 3y ago
    If they can see the screen wouldn’t they be better off just looking at the keyboard to directly observe what’s being typed?
  - jgalt212 3y ago
    > the coffee shop around the corner I would hope people in high leverage job roles would just avoid such behavior.
    - froggit 3y ago
      > I would hope people in high leverage job roles would just avoid such behavior. I used to hope that as well. Then I met people and lost that hope. It's truly impressive how much stupid shit gets pulled by people that "should know better."
- wizofaus 3y ago
  You've never typed a password in while screen sharing?
  - kelnos 3y ago
    Oh god no, absolutely not. Always stop sharing for the duration of the password entry.
    - axus 3y ago
      Sadly I think security systems will have to accommodate the possibility that someone else can see your screen. And hope that they can't see your keyboard.
    - wizofaus 3y ago
      What if you're demonstrating a problem with a login screen? And yes, I've had to do exactly that more than once. I wouldn't do it with a particularly sensitive password (online banking etc) but there are enough passwords I use regularly for work purposes where it wouldn't be a significant risk for others to watch me type it in, certainly if the characters aren't revealed at all while typing. Though having password fields be able to detect your screen is being shared automatically and obscure what pixels are relayed would be nice.
      - jrockway 3y ago
        Why use a good password while testing your login screen? I use "iamroot" and "password".
        wizofaus 3y ago
        They're typically passwords that are only for testing accounts anyway, and that are known to the team members I'm sharing with. But...it's easy to slip up now and then and forget you're actually putting in a password while screen sharing that it's probably best not to have your co-workers know! Obviously the worst is your actual O/S password, as knowing that could potentially allow a co-worker access to other passwords that are quite sensitive, but I'm not sure it's even possible to screen share your O/S login screen - probably shouldn't be! It is a good argument for not re-using that password for any browser-based logins, but SSO policies tend to make that impossible unfortunately. Mind you I use a pin for my O/S login screen, whereas for browser-based logins you can't.
- koheripbal 3y ago
  Plenty of value in confirming that you are hitting each key exactly once.
  - EGreg 3y ago
    Why not just mutate a specific fixed-length line with every keypress?
- glaucon 3y ago
  > I'm honestly seeing little value in asterisks They're essential ! How else would we encourage the average user to use as short and and as simple a password as they can get away with ?
hedora 3y ago
The browser could use a different rendering convention for autopopulated passwords. For instance, it could render a solid black bar (no characters for the user to count) or maybe the phrase "autofilled", perhaps with a strange background color / rendering convention.
smaudet 3y ago
The login fractal - a shape that is infinitely recurring, starts at a random place, and indicates entry with "zooming".
yencabulator 3y ago
I've seen a GUI password input field that mutated an abstract line drawing on every keypress. Think random cross-hatching over the whole input field where the lines are nudged a little on every press. (Not that that's necessarily a good idea, it still gives away timing/length information to e.g. cameras.)
- Vicinity9635 3y ago
  I remember seeing this in Lotus Notes. Never saw it before that, or since.
  - yencabulator 3y ago
    Oh yes, that could be it! Employer made me run Windows in a VM to read corporate email. My memory doesn't match videos I can find online of it, but that could be version differences.
    - compsciphd 3y ago
      At IBM someone made something called fetchnotes that worked like fetchmail, but worked with mail and calendar, made me able to get away with minimal usage of notes.
  - nmstoker 3y ago
    Yes. Wasn't it to make it harder spoof a password prompt with a static image popping up?
    - Cyykratahk 3y ago
      I think it was to provide an indication that the password was correct at a glance. (IIRC the number of dots in the password field was also generated, so it didn't necessarily match the number of chars) The image was essentially a simple checksum. Each user would eventually memorise which icon was "theirs".
- _emacsomancer_ 3y ago
whatusername 3y ago
Lotus Notes used to have that. (Might still do?) https://security.stackexchange.com/questions/41247/changing-picture-as-characters-entered-into-password https://security.stackexchange.com/questions/41247/changing-...
- lhamil64 3y ago
  We used Notes at work until a few years ago and it still had it IIRC. I never stopped to think about why the pictures changed, that's interesting. Another annoying decision is that they prevented pasting passwords, which is very inconvenient when using a password manager. I ended up having to use one that simulated keystrokes.
Too 3y ago
I’ve seen some programs render three asterisks per key stroke. Defers human shoulder surfers from seeing the length of your password. I think simplest and safest solution would be a shape that rotates at random interval for each key stroke. Depends what problem you want to solve. Did keyboard register my press? vs did I type the same thing as last time.? have some different constraints.
slim 3y ago
What about : "You are typing..." like in IM apps

letsdothisagain 3y ago

I'm honestly seeing little value in asterisks with WFH and the move to passphrases. Feedback is important when you're typing a long phrase with complete precision. Plus shoulder surfing is simply not a thing when my physical security profile now involves a locked front door and a call to the police.

iknowstuff 3y ago
Are you describing your experience or implying that the industry should change this because you can WFH?
- froggit 3y ago
  The latter. They seemingly meant "I can WFH, so asterisks are meaningless to everyone. F@&# asterisks!"
autoexec 3y ago
WFH also means Working From my backyard, the coffee shop around the corner, the library, a friend's house, a hotel room, etc. Even for people who only work at home while working remotely, private homes can see a lot of traffic. I wouldn't assume all screens are kept and used in totally secure environments so we should probably still stick with masked passwords and telling users not to keep passwords written on a post-it note stuck to their monitor.
- deleted 3y ago
  [deleted]
- aeternum 3y ago
  And now employees simply leave their laptop open with the SSH window up while getting their coffee because it's now so annoying to close the lid and correctly type the password. >USB Rubber Ducky has entered the chat
- matt-attack 3y ago
  If they can see the screen wouldn’t they be better off just looking at the keyboard to directly observe what’s being typed?
- jgalt212 3y ago
  > the coffee shop around the corner I would hope people in high leverage job roles would just avoid such behavior.
  - froggit 3y ago
    > I would hope people in high leverage job roles would just avoid such behavior. I used to hope that as well. Then I met people and lost that hope. It's truly impressive how much stupid shit gets pulled by people that "should know better."
wizofaus 3y ago
You've never typed a password in while screen sharing?
- kelnos 3y ago
  Oh god no, absolutely not. Always stop sharing for the duration of the password entry.
  - axus 3y ago
    Sadly I think security systems will have to accommodate the possibility that someone else can see your screen. And hope that they can't see your keyboard.
  - wizofaus 3y ago
    What if you're demonstrating a problem with a login screen? And yes, I've had to do exactly that more than once. I wouldn't do it with a particularly sensitive password (online banking etc) but there are enough passwords I use regularly for work purposes where it wouldn't be a significant risk for others to watch me type it in, certainly if the characters aren't revealed at all while typing. Though having password fields be able to detect your screen is being shared automatically and obscure what pixels are relayed would be nice.
    - jrockway 3y ago
      Why use a good password while testing your login screen? I use "iamroot" and "password".
      - wizofaus 3y ago
        They're typically passwords that are only for testing accounts anyway, and that are known to the team members I'm sharing with. But...it's easy to slip up now and then and forget you're actually putting in a password while screen sharing that it's probably best not to have your co-workers know! Obviously the worst is your actual O/S password, as knowing that could potentially allow a co-worker access to other passwords that are quite sensitive, but I'm not sure it's even possible to screen share your O/S login screen - probably shouldn't be! It is a good argument for not re-using that password for any browser-based logins, but SSO policies tend to make that impossible unfortunately. Mind you I use a pin for my O/S login screen, whereas for browser-based logins you can't.
koheripbal 3y ago
Plenty of value in confirming that you are hitting each key exactly once.
- EGreg 3y ago
  Why not just mutate a specific fixed-length line with every keypress?
glaucon 3y ago
> I'm honestly seeing little value in asterisks They're essential ! How else would we encourage the average user to use as short and and as simple a password as they can get away with ?

hedora 3y ago

The browser could use a different rendering convention for autopopulated passwords. For instance, it could render a solid black bar (no characters for the user to count) or maybe the phrase "autofilled", perhaps with a strange background color / rendering convention.

smaudet 3y ago

The login fractal - a shape that is infinitely recurring, starts at a random place, and indicates entry with "zooming".

yencabulator 3y ago

I've seen a GUI password input field that mutated an abstract line drawing on every keypress. Think random cross-hatching over the whole input field where the lines are nudged a little on every press. (Not that that's necessarily a good idea, it still gives away timing/length information to e.g. cameras.)

Vicinity9635 3y ago
I remember seeing this in Lotus Notes. Never saw it before that, or since.
- yencabulator 3y ago
  Oh yes, that could be it! Employer made me run Windows in a VM to read corporate email. My memory doesn't match videos I can find online of it, but that could be version differences.
  - compsciphd 3y ago
    At IBM someone made something called fetchnotes that worked like fetchmail, but worked with mail and calendar, made me able to get away with minimal usage of notes.
- nmstoker 3y ago
  Yes. Wasn't it to make it harder spoof a password prompt with a static image popping up?
  - Cyykratahk 3y ago
    I think it was to provide an indication that the password was correct at a glance. (IIRC the number of dots in the password field was also generated, so it didn't necessarily match the number of chars) The image was essentially a simple checksum. Each user would eventually memorise which icon was "theirs".
_emacsomancer_ 3y ago

whatusername 3y ago

Lotus Notes used to have that. (Might still do?) https://security.stackexchange.com/questions/41247/changing-picture-as-characters-entered-into-password https://security.stackexchange.com/questions/41247/changing-...

lhamil64 3y ago
We used Notes at work until a few years ago and it still had it IIRC. I never stopped to think about why the pictures changed, that's interesting. Another annoying decision is that they prevented pasting passwords, which is very inconvenient when using a password manager. I ended up having to use one that simulated keystrokes.

Too 3y ago

I’ve seen some programs render three asterisks per key stroke. Defers human shoulder surfers from seeing the length of your password. I think simplest and safest solution would be a shape that rotates at random interval for each key stroke. Depends what problem you want to solve. Did keyboard register my press? vs did I type the same thing as last time.? have some different constraints.

slim 3y ago

What about : "You are typing..." like in IM apps