4 ms·

Schneier says he was 'probably wrong' on masked passwords

31 points by prodigal_erik 17y ago

prodigal_erik 17y ago
(this is a followup to http://news.ycombinator.com/item?id=676480 http://news.ycombinator.com/item?id=676480)
TheAmazingIdiot 17y ago
Well, has anybody thought that both decisions are right? I mean, sometimes you _really_ are alone, with nobody shoulder surfing, and password masking is damned annoying. So, why not a check-box to turn masking off? And for the paranoid/security conscious, we can default mask on. Think: "Middle Path".
- inerte 17y ago
  So, every time I type my password I should check that nobody is behind me? Look to the right, look to the left, look behind, type one key. Look to the right, look to the left, look behind, type one key. Look to the right, look to the left, look behind, type one key. "Mask-on by default" means no regular user will ever uncheck. I think you greatly overstimate people's security knowledge, not to mention UI.
  - TheAmazingIdiot 17y ago
    Then perhaps you need to re-read what I said. By default, the masking would be enabled. All you see are "*". If however, you have some nasty password and you are in a safe location, you can do_action and turn off stars to "12345".
    - inerte 17y ago
      No regular user would ever turn the masking off. They simply don't click on these additional options. Heck, they don't even understand why it's there. Can you explain what's the checkbox's purpose? Why and when should it be turned off? As a security expert, you should provide what's more secure, even if that means recognizing the users are too dumb to follow your rules.
      - staunch 17y ago
        You're basing your opinion on no data, I presume? I'd bet that some users absolutely would turn off the masking, if you made it easy/clear enough.
        timcederman 17y ago
        Really? If they're attentive enough to turn off masking, why wouldn't they just enter their password into notepad and then copy/paste?
        huhtenberg 17y ago
        Because it's less convenient.
        inerte 17y ago
        And what data do you have? I don't have statistics favouring a checkbox password masking option neither. We're into untested territory thinking here, and I don't believe calling for statistics will disprove anyone. In the absence of hard numbers, I take your challenge. staunch, I bet you $25 (via PayPal) that two users will not uncheck password masking off, when presented with an explanation what it's for, without looking either to the left, right or behind before typing the password.
        staunch 17y ago
        I think the percentage will come down to demographics, the kind of site, the copy, and ten other variables. My wild guess is that it will be 5%+ without trying hard. I'll probably try this on one of my sites (I've tried no masking before). Maybe I'll blog it. You can keep your $25.
      - kailashbadu 17y ago
        No regular user would ever turn the masking off So what is the harm there? Even if a user could not figure out (oddly) what the checkbox does, he'll continue to get the password field to behave in the way he is accustomed to. Surely, people will have trouble figure out the purpose of the checkbox in the beginning. But that's how things tend to be when you run into something for the first time. It takes some time before a style becomes standard.
keyist 17y ago
Why is this still an issue? The problem of displaying passwords has been solved by Unix years ago: do not show any visual feedback whatsoever. Security over convenience. The problem of storing and subsequent input of random secure passwords has also been solved by Schneier and others via pwsafe and variants thereof. No worries about mistyping at all. For special cases like Blackberry-type gadgets, what is needed is simply a port of pwsafe.
huhtenberg 17y ago
I don't really know what the fuss is about since the simplest solution is the most obvious one. Masking should be optional, it should be enabled by default and controlled by the checkbox next to the entry field.
- mhansen 17y ago
  That's the simplest solution in terms of people, but it adds another layer of complexity to whatever technology you're working with.
  - ErrantX 17y ago
    Not if the browsers implement it (which seems the best solution)
    - pclark 17y ago
      sounds awful. So now you're putting a checkbox next to any password field? Designers have to be aware that in some browsers there'll be a checkbox next to password fields.
      - dchest 17y ago
        How a tiny button inside the password field like the "Browse" or "Choose file" in file upload field?
        pavel_lishin 17y ago
        That button isn't tiny, and is in fact very obtrusive. It makes creating designs and layouts hard enough as it is, and the file dialog isn't even used very often. I'm pretty sure you can implement something like this on the web with some simple javascript, dynamically changing the input type from "text" to "password" and vice versa.
        calcnerd256 17y ago
onreact-com 17y ago
Just make password masking a choice. For many people working mostly at home the only person "shoulder surfing" will be a family member. Masking passwords is really an annoyance. I don't want to know how many hours get wasted on retyping passwords over the years. Also people tend to save passwords to overcome the typing annoyance thus making them less secure.
pclark 17y ago
Don't make it optional. Security over convenience. I blogged about this here: http://is.gd/1wVja http://is.gd/1wVja
ahoyhere 17y ago
On our signup form for our time tracking service, the password fields are clear text, with a checkbox available to hide it that says "I'm being watched!" Because... the credit card numbers are also clear text. People on HN, for example, will have a freakout about the password but never the credit card number. It's extremely unusual to shield a credit card number on entry, because of mistakes. We chose to treat passwords the same way.
- bodhi 17y ago
  Have you done it both ways? I'd be interested to see any stats you have if you are willing to share. Good point about the credit card number too.
- pavel_lishin 17y ago
  I think it's much harder to memorize a 16 digit number rather than a (usually) mnemonic password.
comice 17y ago
I wonder how this affects Schneier Facts: http://www.schneierfacts.com http://www.schneierfacts.com
- GavinB 17y ago
  "Most people use passwords. Some people use passphrases. Bruce Schneier uses an epic passpoem, detailing the life and works of seven mythical Norse heroes." Given this fact, it's not too hard to see why he would have come out against masking . . .

31 points by prodigal_erik 17y ago

(this is a followup to http://news.ycombinator.com/item?id=676480 http://news.ycombinator.com/item?id=676480)

Well, has anybody thought that both decisions are right? I mean, sometimes you _really_ are alone, with nobody shoulder surfing, and password masking is damned annoying. So, why not a check-box to turn masking off? And for the paranoid/security conscious, we can default mask on. Think: "Middle Path".

inerte 17y ago
So, every time I type my password I should check that nobody is behind me? Look to the right, look to the left, look behind, type one key. Look to the right, look to the left, look behind, type one key. Look to the right, look to the left, look behind, type one key. "Mask-on by default" means no regular user will ever uncheck. I think you greatly overstimate people's security knowledge, not to mention UI.
- TheAmazingIdiot 17y ago
  Then perhaps you need to re-read what I said. By default, the masking would be enabled. All you see are "*". If however, you have some nasty password and you are in a safe location, you can do_action and turn off stars to "12345".
  - inerte 17y ago
    No regular user would ever turn the masking off. They simply don't click on these additional options. Heck, they don't even understand why it's there. Can you explain what's the checkbox's purpose? Why and when should it be turned off? As a security expert, you should provide what's more secure, even if that means recognizing the users are too dumb to follow your rules.
    - staunch 17y ago
      You're basing your opinion on no data, I presume? I'd bet that some users absolutely would turn off the masking, if you made it easy/clear enough.
      - timcederman 17y ago
        Really? If they're attentive enough to turn off masking, why wouldn't they just enter their password into notepad and then copy/paste?
        huhtenberg 17y ago
        Because it's less convenient.
      - inerte 17y ago
        And what data do you have? I don't have statistics favouring a checkbox password masking option neither. We're into untested territory thinking here, and I don't believe calling for statistics will disprove anyone. In the absence of hard numbers, I take your challenge. staunch, I bet you $25 (via PayPal) that two users will not uncheck password masking off, when presented with an explanation what it's for, without looking either to the left, right or behind before typing the password.
        staunch 17y ago
        I think the percentage will come down to demographics, the kind of site, the copy, and ten other variables. My wild guess is that it will be 5%+ without trying hard. I'll probably try this on one of my sites (I've tried no masking before). Maybe I'll blog it. You can keep your $25.
    - kailashbadu 17y ago
      No regular user would ever turn the masking off So what is the harm there? Even if a user could not figure out (oddly) what the checkbox does, he'll continue to get the password field to behave in the way he is accustomed to. Surely, people will have trouble figure out the purpose of the checkbox in the beginning. But that's how things tend to be when you run into something for the first time. It takes some time before a style becomes standard.

keyist 17y ago

Why is this still an issue? The problem of displaying passwords has been solved by Unix years ago: do not show any visual feedback whatsoever. Security over convenience. The problem of storing and subsequent input of random secure passwords has also been solved by Schneier and others via pwsafe and variants thereof. No worries about mistyping at all. For special cases like Blackberry-type gadgets, what is needed is simply a port of pwsafe.

huhtenberg 17y ago

I don't really know what the fuss is about since the simplest solution is the most obvious one. Masking should be optional, it should be enabled by default and controlled by the checkbox next to the entry field.

mhansen 17y ago
That's the simplest solution in terms of people, but it adds another layer of complexity to whatever technology you're working with.
- ErrantX 17y ago
  Not if the browsers implement it (which seems the best solution)
  - pclark 17y ago
    sounds awful. So now you're putting a checkbox next to any password field? Designers have to be aware that in some browsers there'll be a checkbox next to password fields.
    - dchest 17y ago
      How a tiny button inside the password field like the "Browse" or "Choose file" in file upload field?
      - pavel_lishin 17y ago
        That button isn't tiny, and is in fact very obtrusive. It makes creating designs and layouts hard enough as it is, and the file dialog isn't even used very often. I'm pretty sure you can implement something like this on the web with some simple javascript, dynamically changing the input type from "text" to "password" and vice versa.
        calcnerd256 17y ago

onreact-com 17y ago

Just make password masking a choice. For many people working mostly at home the only person "shoulder surfing" will be a family member. Masking passwords is really an annoyance. I don't want to know how many hours get wasted on retyping passwords over the years. Also people tend to save passwords to overcome the typing annoyance thus making them less secure.

pclark 17y ago

Don't make it optional. Security over convenience. I blogged about this here: http://is.gd/1wVja http://is.gd/1wVja

ahoyhere 17y ago

On our signup form for our time tracking service, the password fields are clear text, with a checkbox available to hide it that says "I'm being watched!" Because... the credit card numbers are also clear text. People on HN, for example, will have a freakout about the password but never the credit card number. It's extremely unusual to shield a credit card number on entry, because of mistakes. We chose to treat passwords the same way.

bodhi 17y ago
Have you done it both ways? I'd be interested to see any stats you have if you are willing to share. Good point about the credit card number too.
pavel_lishin 17y ago
I think it's much harder to memorize a 16 digit number rather than a (usually) mnemonic password.

comice 17y ago

I wonder how this affects Schneier Facts: http://www.schneierfacts.com http://www.schneierfacts.com

GavinB 17y ago
"Most people use passwords. Some people use passphrases. Bruce Schneier uses an epic passpoem, detailing the life and works of seven mythical Norse heroes." Given this fact, it's not too hard to see why he would have come out against masking . . .