Nielsen Recommends Not Masking Passwords 849
Mark writes "Usability expert and columnist Jakob Nielsen wants to abolish password masking: 'Usability suffers when users type in passwords and the only feedback they get is a row of bullets. Typically, masking passwords doesn't even increase security, but it does cost you business due to login failures.' I've never been impressed by the argument that 'I can't think why we need this (standard) security measure, so let's drop it.' It usually indicates a lack of imagination of the speaker. But in this case, does usability outweigh security?"
Making my point with humor (Score:5, Funny)
Usability? What the hell is he talking about? The user doesn't see the dots, only other people see those. The user should see their own password when they type it. Maybe he should check his glasses because those characters must be so blurry to him that they look like dots.
Re:Making my point with humor (Score:5, Funny)
Re:Making my point with humor (Score:5, Interesting)
Actually, the comment is (perhaps unintentionally) insightful. According to the current (25th June 2009) draft of the HTML 5 spec:
Re: (Score:3, Informative)
But if you read that carefully, you'll note that it does not say that the user can see it. It allows for implementations that totally obscure the password, and implementations that let the user see the password (as long as others can't). And it doesn't suggest how the latter might be done.
I think it was very carefully worded. Or maybe it was just an
Re:Making my point with humor (Score:5, Funny)
Re:Making my point with humor (Score:5, Insightful)
That's because knowing the number of characters in a password greatly eases the password guessing.
The masking is indeed a bad idea. Your unix login prompt does the right thing.
You could always let the user choose (Score:5, Insightful)
In a secure environment, with no one looking over my shoulder why not leave the chars in the clear?
Give 'em a checkbox: "Echo password []" which defaults to "unchecked" of course.
Re: (Score:3, Informative)
Nielsen is being an idiot (Score:3, Insightful)
With unmasked passwords, you'd have to change important passwords whenever someone walks past you just as you're typing them in. This scenario can be so common - office, starbucks, etc.
Nielsen talks about usability, so how usable is that?
In contrast if someone was _standing_ close by and you suspect him of
Re: (Score:3, Insightful)
Do you really expect users, to know if their environment is secure?
On the other hand, it's a great idea. More cracked accounts, more retards hurt, less retards being successful, less retards reproducing, and the global IQ rises.
Seriously, I miss the intelligence boost that harsh times give humanity. :/
Re:You could always let the user choose (Score:5, Interesting)
For what it's worth, I've had a password compromised before by someone looking over my shoulder at what *keys* I typed. I'd rather not make it even easier for people by letting them just look at the screen, thanks. As you note, you never know whether your environment is secure. In my case, back in TAMS, I had a "friend" who was chatting with me as an excuse to stand close enough / above me to see the keyboard; he then set up a porn site on my university account as a prank.
Strangely enough, the last I heard from him, he was becoming a Mormon missionary...
Re: (Score:3, Informative)
With this extension built into every web browser security would improve in leaps and bounds.
For lazy people you can mix it with Secure Login [mozilla.org] or the Opera Wand.
After all, once an attacker has local access to your machine all bets are off right? Password Hasher makes guesses/brute forcing passwords as close to impossible as it needs to be. 26 characters should be enough for anyone, surely?
Re: (Score:3, Funny)
Re:You could always let the user choose (Score:5, Funny)
Re:You could always let the user choose (Score:5, Informative)
Re:You could always let the user choose (Score:4, Insightful)
Your sig should be "Don't shoulder surf my password bro!" This is a situation where compromise is not appropriate. The unix login prompt has proper behavior. The story post is correct; obscured characters are dumb. The assumption that therefore they should be shown in plain text is incorrect. Your password should not be shown at all as you are typing it or at any time in any representation.
Re:Making my point with humor (Score:5, Funny)
I think passwords should spin, and any right characters you try should make that digit stop spinning, to let you know that character was right. That would put things more in line with the movies and make hacking a lot more fun.
.
Re:Making my point with humor (Score:4, Funny)
OMG! Could this be a way to make linux the most widely used OS? Write a GUI that looks like the computers on TV? Although you would need a monitor that projected the text onto the user's face.
Re:Making my point with humor (Score:4, Informative)
Lotus Notes had (has?) a login dialog that addressed this by showing a random number of X's for each character rather than a 1-to-1 mapping.
... and bloody awful it was too. What the hell was the point of showing the dots at all? At least with one dot per character you've got visual feedback of how many characters you've typed. Seeing six dots in the password field when you've only typed three characters is confusing and jarring.
Re:Making my point with humor (Score:5, Funny)
What's even better is that the dialog doesn't indicate whether it has focus or not, so you end up typing your password into your IM window.
Re:Making my point with humor (Score:5, Insightful)
What's even better than that is when the password input window *does* have focus, and the IM window steals it just as you start to type it in.
focus-stealing windows should be banned.
Re: (Score:3, Insightful)
focus-stealing windows should be banned.
And you can ban it. At least in XFCE, it's a standard option whether to give newly created windows focus or not (I leave it on because I find that behavior more intuitive than a window popping up and me having to move my mouse over it to start typing in it).
If you can't configure this basic option in your window manager, well, maybe it's time to change your WM?
Re: (Score:3, Insightful)
Re: (Score:3, Insightful)
Why did you bother explaining? Don't you see what a missed opportunity that was? If they don't log in, they can't fuck anything up!
Re: (Score:3, Interesting)
I've never even seen my password in plain text. I don't want to either. Ever.
Also, what if your kid sees the password you use at home and decides to play around? I know I would have when I was a kid and my instructor used to login to his DOS account with a password (where the cursor never moved let alone display the number of characters with dots).
Irreparable damage
Re:Making my point with humor (Score:5, Funny)
I've never even seen my password in plain text. I don't want to either. Ever.
That's good, only your hands should know your password.
Re:Making my point with humor (Score:5, Insightful)
Dude, I want *your* computer. Or your glasses. Or something.
You have illustrated the point nicely. However, the fact is that there is a problem here. The average naive user thinks that when they type a password in, and it's hidden, that means that it's secure. They equate the dots with end-to-end security. And of course there is no end-to-end security. So actually the dots are a usability problem - just not the one Mr. Nielsen suggests.
Fundamentally, the problem is that there is no security in the way passwords are done on the net. By this I mean that even though we do have security protocols like SSL, and we do have mechanisms for signing certs, the current security model assumes that the user will discriminate between situations where there is security, and situations where there is not. And nearly every single user of web services is incapable of discriminating in that way. There are maybe one or two thousand people in the world who really understand the security model well enough and are anal enough to actually validate the security of what they are doing when they enter passwords into web forms.
So essentially Mr. Nielsen is right - you might as well not bother with the dots. Because they just give you a false sense of security.
hunter2 (Score:5, Funny)
Nielsen is finally getting even for that old prank we pulled on him back in the day ;)
http://bash.org/?244321 [bash.org]
Re:hunter2 (Score:5, Funny)
Hmm... I always thought the forums I frequent had some censor for bad words, but I guess it's a password filter. That's neat.
I wonder if /. also has a feature like that, let me try it. Pen1s
Re:hunter2 (Score:5, Funny)
Hmm... I always thought the forums I frequent had some censor for bad words, but I guess it's a password filter. That's neat.
I wonder if /. also has a feature like that, let me try it. *****
Hey that worked, try some of your other passwords.
Re:hunter2 (Score:5, Funny)
Neat, let me try a longer one. Erecti0n
Re:hunter2 (Score:5, Funny)
Cool, that worked also. Do you have anything harder?
Re:hunter2 (Score:5, Funny)
Harder than erecti0n?
Re:hunter2 (Score:5, Funny)
Re:hunter2 (Score:5, Funny)
System Error:
Password too short.
hunter2 (Score:4, Interesting)
Usability expert and columnist Jakob Nielsen
Well, I'm glad they found such an unbiased and informed person to make such a statement about security versus usability. And for a second there I was afraid he was just doing this for attention.
... no input is recorded in anyway on the screen. Now that's a usability nightmare when you can't even backspace to correct your errors. I don't think I've seen this since my days in a computer lab at college but I think sacrificing a few login attempts worth of time is worth the security.
Mr. Nielsen, could you send us screen shots of a working example? Perhaps show us how it looks like when you log into the administrative console now with your password entered in and then a screenshot of the way you think it would be more usable. I'll review them and let you know in a most interesting way [bash.org] what I think.
Perhaps you should read up on our friend Kevin Mitnick [wikipedia.org] and NASA "Hacker" Gary McKinnon [slashdot.org] both of whom are no strangers to the over-the-shoulder-attack. Really, I'm no security expert or pen tester but I'm going to speculate that these 'soft hacks' are some of the most dangerous vulnerabilities left. Your suggestion just makes them all the more easier. Me personally would like to see the standard bumped up to the level of the input box not even being masked
Typically, masking passwords doesn't even increase security ...
[citation desperately needed]
... I mean it's bad enough that the sound waves of my keystrokes are floating around telling people my password [slashdot.org]. Sorry to go all tinfoil hat on you there.
I think back to the few times when I've entered my password accidentally into the username box because the tab key I hit didn't register or the site didn't support it and I just felt nervous and dirty and needed to change my password. Just knowing that there were photons and radiation [slashdot.org] everywhere in my cube belying my password to anyone who cared to capture them
Re:hunter2 (Score:4, Interesting)
Seriously, if you only evaluate software based on usability, then it is BAD to even require a password.
Requiring a password INSTANTLY makes software harder to use. Not requiring a password makes the user's life much easier and simpler.
Now if you care about more than just usability, then you may want to reconsider dropping or masking passwords.
Re: (Score:3, Insightful)
Same thing with email addresses in online forms, why do I always have to type those in twice?
That's to reduce the chances you have a typo. Some even explain that.
I have no idea about the MS thing, it's probably because their WLAN taskbar applet sucks hard.
Microsoft wep key (Score:5, Insightful)
The microsoft wireless access passwords are done like that because they are complete idiots. Why do you have to type it in twice?? If it works on the first try, why use the second field at all?
Re:Microsoft wep key (Score:5, Informative)
Why you have to type our WiFi password twice: (Score:5, Funny)
Why you have to type our WiFi password twice:
The first time sends the password to my botnet.
The second time actually logs you in.
-- Terry
Re:hunter2 (Score:5, Interesting)
Re: (Score:3, Funny)
Re: (Score:3, Insightful)
You might want to RTFA before typing out such a long post. If you did, you'd notice a few things.
1) He's specifically advocating this for login forms on the web
2) He specifically says that security trumps usability in some instances
3) He gives a very clear example of a way to enable/disable this feature
With the proliferation of mobile devices with tiny, sometimes virtual, keyboards, typos are very common. When you can't even see that you've made a typo because it is obscured by dots, then you have no chan
Re:hunter2 (Score:5, Insightful)
Re: (Score:3, Interesting)
I agree with eldavojohn and everyone else who has the various examples/anecdotes/satirical comments. Showing passwords to anyone nearby or with binoculars, telescopes, or cameras is not ve
Re:hunter2 (Score:5, Funny)
That's why you should always use a Dvorak keyboard. Without the letters on the caps. Just to be sure.
Re: (Score:3)
Re:hunter2 (Score:5, Insightful)
No, but if Stephen Hawking made a claim that flew in the face of established conventions in - say - psychology, I would expect a citation. Nielsen is a usability expert, not a security expert, and GP questioned his claim about the security aspect.
Re:hunter2 (Score:5, Insightful)
If Stephen Hawking says something about physics, do you require a citation from him? Nielson is recognized as one of the leading experts in his field.
Yes! I would! I would want to see the research that lead him to his conclusion in physics. Or, more specifically, I would want another physicist to look at his research and give his validation to say that it's sound.
Re: (Score:3, Insightful)
If Stephen Hawking says something about physics, do you require a citation from him? Nielson is recognized as one of the leading experts in his field.
Not at all. But I wouldn't listen to his ideas on beating the Taliban in Afganistan.
Re: (Score:3, Insightful)
Stephen Hawking would generally be expected to have something to back up his statements. People don't just come up with stuff out of thin air. They do research, experiment, formulate hypotheses and test them. That becomes the body of evidence on which Hawking would base his statements. What kind of evidence does Nielsen have to back his remarks? Polls? Focus groups?
Nielsen is essentially recommending that usability should trump security which is not necessarily the right answer. Now if he wants to recommend
Re: (Score:3, Insightful)
He's not a security expert, but he IS a useability expert (even though I, a non-expert, often disagree with some of the things he writes).
He's the seventh grade English teacher of usability experts. Everything he says is useful the first time you hear it, but most of it is wrong.
Re: (Score:3, Insightful)
Nielsen is not universally revered in HCI (/usability) circles, and we don't really have a Steven Hawking-like figure. He has done some pretty solid work in the past, but that only goes so far. A lot of UI/UX/ practitioners I know don't think highly of his recent stuff. So, [citation needed] is right, but [open mind needed] is as well.
I love my field, but it i
Two words (Score:5, Insightful)
Shoulder surfing.
Seriously, is this guy is supposed to be an expert?
This is like having a fuel efficiency expert tell you to turn the motor off on your car, stick it in neutral, and push it, since it'll get infinite MPG. Passwords are supposed to be secret. Usernames aren't as critical.
Re:Two words (Score:5, Insightful)
I'd rather have to retype the occasional password than have it visible to anyone shoulder surfing.
Think about your bank card, your PIN, etc.
FTFA:
Retarded doesn't begin to cover this. Offering a default to turn OFF password masking for bank accounts? I'm sure the banks will just LOVE this one. We have enough problems with identity theft already.
Re:Two words (Score:5, Insightful)
Retarded doesn't begin to cover this.
The best thing about the article, typical of an unfortunately large amount of usability literature, is the complete absence of empirical data. He simply asserts, for example, "users will not be confused by this" without offering a shred of empirical evidence for the claim. I'm not a typical user, but I'd sure as hell be confused if plaintext started to appear in the UI where a decade or two of experience has taught me to expect a line of bullets. I sure as hell wouldn't want to be on a helpdesk for a system that has just made this change.
Usability is an important area of software design, but it is still in its infancy, and the lack of usability experts chiming in to call this guy a blithering idiot is depressing. All claims about usability of any feature should be considered nonsense until someone comes to you with empirical data from real users that tell you what they find usable. Otherwise you're arguing mythological hypotheticals--how many users can dance on a pinhead.
Re: (Score:3, Insightful)
Offering a default to turn OFF password masking for bank accounts?
As many banks use one time passwords, that might actually be one of the few places where unmasked passwords are acceptable.
Otherwise, no way. For those with very bad keyboard skills there are workarounds like using keyboard patterns and with cellphones you can use longer passwords but without multiple-click use of buttons.
Slightly easier input simply isn't worth it; not only don't I want to reveal my passwords to any furtive glance, I don't w
Re: (Score:3, Insightful)
expert(n): Someone who will charge you a large amount of money to state the obvious (possibly to someone else who needs to be convinced of something).
The real geniuses of the world don't go around calling themselves "experts", they just do nifty things and solve interesting and difficult problems.
Re: (Score:3, Interesting)
Now here's a list of Mr. Nielsen's publications in the field of usability. [interaction-design.org] Also a short biography [wikipedia.org] of the man on wikipedia, listing some of his educational background & contributions.
Given all this, two points:
Another two words (Score:4, Insightful)
Saved Passwords.
I typically have my web browser save my passwords for things I consider lower risk, but if masking is removed and the browser automatically loads the password into the form, then it's available to anyone. Considering that many users use the same or similar passwords for almost every application, and having it unmasked on one site could give up your info on any number of other sites.
Re:Another two words (Score:4, Informative)
Oh really? Even if your browser won't just show them to me [howtogeek.com] I can still get them easily if I have physical access to your browser and I am able to successfully guess which sites you frequent:
javascript:for(var a=document.getElementsByTagName("input"),i=0;i<a.length;i++)if(a[i].type=="password")void(a[i].type="text");
I'm not flaming Firefox for showing the passwords. What I am saying is simple... if your browser does save passwords, secure either the browser (Firefox has a master password) or the computer (via an account password, and don't leave the desktop logged in). The asterisks are a secure enough method of obscuring your password from someone looking over your shoulder, but they are not a secure method of obscuring your password from someone who's actually sitting at the computer keyboard.
Re:Two words (Score:5, Insightful)
Oh, c'mon.
So, password masking doesn't even protect fully against snoopers.
No, it doesn't protect fully, but it does protect from everyone who can't see the keyboard when you type. In other words, it protects against every shoulder-surfing scenario except when the person is looking directly at the keyboard when you type. And even then, if you're typing fast enough or the keys are close enough together you won't be able to guess the password by watching the keyboard. Hell, I'm sitting right in front of the keyboard and I still can't look through my hands to see which keys my fingertips are actually pressing. So, password masking does protect from shoulder-surfing. It might not protect against people looking directly at your keyboard, but that might be because it's designed specifically to protect against people looking at the goddamn monitor.
More importantly, there's usually nobody looking over your shoulder when you log in to a website. It's just you, sitting all alone in your office, suffering reduced usability to protect against a non-issue.
OK, so this is a great usability solution for websites that only get accessed by people sitting alone in their offices without the possibility of a co-worker standing there as they log in. For all other sites that people might access in an internet cafe, or at the airport, or in a coffee shop, or wherever else, I guess it doesn't apply at all.
Lotus Notes (Score:3, Funny)
Re: (Score:3, Interesting)
As long as your glyph matched what you remembered, you knew that you'd typed the password correctly.
So anyone could just remember your heiroglyphs and then try passwords until they got a match? Nice. I don't think it actually worked that way.
Re:Two words (Score:5, Funny)
Most websites (and many other applications) mask passwords as users type them, and thereby theoretically prevent miscreants from looking over users' shoulders. Of course, a truly skilled criminal can simply look at the keyboard and note which keys are being pressed. So, password masking doesn't even protect fully against snoopers.
Might as well just put all my expensive electronics on the front lawn, since a truly skilled burglar can simply pick the lock and steal it anyway. So, keeping your valuables behind closed doors doesn't even protect fully against theft. It sure as hell makes it more difficult for casual thieves though, which is probably nearly all of them.
More importantly, there's usually nobody looking over your shoulder when you log in to a website. It's just you, sitting all alone in your office, suffering reduced usability to protect against a non-issue.
Not all of us have those nice cushy jobs Mr. Nielsen has, where we have our very own office. Roughly 99.9993% of office workers have colleagues. I guess Mr. Nielsen is just a tad detached from reality here.
Re:Two words (Score:5, Interesting)
Sure, being the RTFA troll, I read the article. But that still doesn't convince me. The keyboard press is a brief instant on a device which is easy to place more or less out of line of sight. A visible password on a screen is present for a long time and there are a number [schneier.com] of interesting [newscientist.com] ways to capture this. Whilst keyboards are not perfect [itworld.com] I think that some protection is worthwhile. One thing is for sure. Nobody is going to remember to turn this on when they are in public and your password only needs to be captured once.
One thing that might be a possible compromise is the system the mail client on my Nokia phone uses. The most recent character entered in the password is displayed for a short time. I can see each individual character, but the entire password is not exposed. I worry on the subway, but since it's a personal device it's easier to make this difficult to see.
Re:Two words (Score:5, Interesting)
Well, that's the crux isn't it?
To a usability expert, expectations are your friends. You trust them. You believe in them.
To a security expert, expectations are your enemies. You distrust them. You try to figure out what they're hiding from you.
Of course, everyone agrees that what is expected and what happens *should* be the same, but I think here the securities guys have the more legitimate concern. Mr. Nielson doesn't even considers the possibility that his expectations might be violated. He assumes they are benign as long as they are "usually" right.
What does "usually" mean? *You the user* may "usually" type the password where you can't be watched (although how Nielson knows this applies to me I have no idea). But the usual case for the *criminal* is the situation where *some* user is being vulnerable. He doesn't care about the legions of users who are not exposed to a problem. He cares about the sufficient number of users to his purpose that are. He *seeks* what we consider negligible and makes his home there.
Suppose I design a web site with ten thousand users a day. Suppose a certain situation comes up only 1/10 of one percent. of the time for any given user on any given day. To a usability expert that's negligible. To a security expert, that means I'll be guaranteeing ten exposures to vulnerabilities per day. That's great for attackers. They don't care that *most* users aren't exposed to this problem *most* of the time. They only care that *some* users will be exposed to this problem nearly *all* of the time.
All engineering is about balancing costs and benefits. But you've got to know the probabilities, and to do that right you've got to determine the right population to calculate them with. Once we've established that the "unusual" user case is the "usual" attacker case, we have to recalculate our cost estimates. Where an attack is extremely unlikely, Mr. Nielson is correct in saying that the increment of security that masking gives is small. We're talking about very, very small probabilities, so the only increment we might rationally care about is dropping the probability to zero. Since some criminals can read keystrokes from a keyboard (although by no means many), we don't achieve that. Therefore masking is useless.
However, from the perspective of the attacker and site owner, a situation where some users are exposed to this kind of attack is quite common. It literally happens all the time for a large site. Therefore if masking repulsed, say, 50% of attacks (being very, very conservative), it's still worth doing if you want to keep your site secure, or care about possible violations of user privacy.
Re: (Score:3, Interesting)
Um, here's a thought. (Score:5, Interesting)
Howzabout we make it optional, so people can decide for themselves?
Re:Um, here's a thought. (Score:5, Insightful)
Add smarts to browsers, not pages! (Score:3, Insightful)
[browsers] remember what you put in normal text fields.
Well, here's an easy fix: browsers add a checkbox-ish context menu item to password fields saying "don't hide text behind dots". Pages don't have to do anything, and browsers don't need to change caching behavior.
On the other hand, we only post passwords over HTTPS which browsers don't cache anyways. Right, slashdot? Right? Harumph :(
Re: (Score:3, Informative)
On the other hand, we only post passwords over HTTPS which browsers don't cache anyways.
Most all browsers will save form data entered on a page served over SSL just as they do over non-SSL.. ?
Re: (Score:3, Informative)
javascript:for(var a=document.getElementsByTagName("input"),i=0;i<a.length;i++)if(a[i].type=="password")void(a[i].type="text");
Bookmark it if you want.
For bonus points, set a timeout that restores all the fields you changed to their original password types after a few seconds.
How about a compromise? (Score:5, Insightful)
Personally, I rather like the way many cellphones handle this: show the letter that was typed for a moment and THEN mask it. This allows you to spot typos and correct them without having to blank the field and start over.
Ever typed a long WPA key into an iPhone? (Score:5, Insightful)
The cellphone method works great and has never bothered me until I had to enter a 63-character WPA key into an iPhone. This is something you can't do from memory, so you're moving your eyes back and forth between a plaintext copy, and trying to remember just where you left off. Agony.
Basically, in a few situations like this, it would be really handy to turn off masking one-time-only.
Re: (Score:3, Informative)
And now that you bring that up, it made me curious. I just checked, and the iPhone OS 3.0 does support pasting into password fields, including the WPA passphrase field! You could now type it up in the Notes program (or any other text field, but whatever), copy and paste it, then delete the note. (Well, now you can, anyway)
It's time! (Score:3, Interesting)
I agree, it's time to switch to the Unix password entry scheme. No feedback is good feedback!
Easy solution (Score:5, Insightful)
Re: (Score:3, Funny)
One word for Nielsen: Projector (Score:5, Insightful)
Re: (Score:3, Funny)
I've seen it.
There was this guy wanting to do a presentation in front of around 50 people on a ubuntu laptop and he typed his password in the "User" textedit of login window. Everyone erupted with laughter because his password was "jebenica_l01" (something like fuckery lol in english). I don't blame him too much, that login window has serious flaw with showing only one textedit at the time and both of them in the same place which can lead to situation like this when people are under pressure. Needless to sa
Security (Score:3, Insightful)
One of the most irritating things is the way many websites, especially financial websites, are designed with no thought to the difference between use in a public setting and use in a private setting. For instance, I only ever use my banking website from one place, my den, which is physically secure, yet I have to suffer through all sorts of crap designed to make sure my account doesn't get compromised in a public setting. (The most annoying being automatic log outs for non-use.)
Masking passwords, logging off the user on non-use after ten minutes, and other such security methods do not actually decrease the chance of compromise significantly when the user has physical security. Websites should allow for this.
Re: (Score:3, Insightful)
Indeed lack of imagination (Score:5, Insightful)
1) If I look outside my office window, I can see about 48 office windows (without standing up) and all of them have the lights on and it's dusk outside. Give me a dSLR and a decent set of long distance lenses and I'll prove you wrong.
2) How many times have you typed in your password while somebody was looking at your screen eg. to show somebody something on a protected website. This happens a lot to tech people as we have to authenticate to solve an issue while somebody is standing next to me waiting for me to fix it.
3) How many times have you given a presentation where your screen view (but not your keyboard input) goes worldwide (eg. teleconference) or over a set of wires that you know haven't been tampered with (conference room) - again, logging in to your webmail or so to find a copy of your presentation.
4) How difficult is it to create a script that takes screenshots - how difficult is it to create a script that captures keyboard entry as well. Answer: the first can be done in userspace (and in the hands of an experienced script kiddie would be unnoticed), the latter usually has to go as a request to a driver, kernel or other layer that requires admin rights. This is true for Windows, Mac and (depending on your GUI) Linux
Re: (Score:3, Insightful)
I can do it for linux and Windows pretty quickly, not sure about OS X, but I can do it on FreeBSD or any X server really.
All I need is to get you running a process that does my dirty work in Windows, certainly not difficult. With an X server involved all I need to do is get an app that can connect to your X server and sniffing becomes easy. Failing that, in both Windows and most unix flavors I can always just futz with your user profile and use LD_PRELOAD to make sure I see all your stdio. Don't think it
Re: (Score:3, Interesting)
4) How difficult is it to create a script that takes screenshots - how difficult is it to create a script that captures keyboard entry as well. Answer: the first can be done in userspace (and in the hands of an experienced script kiddie would be unnoticed), the latter usually has to go as a request to a driver, kernel or other layer that requires admin rights. This is true for Windows, Mac and (depending on your GUI) Linux
hmm...
SetWindowsHookEx()
Hidden department revealed! (Score:3, Informative)
Don't_mask_my_password
(I used my stealthy password exposer to find that out.)
Two more words for Nielsen: Security Cameras (Score:5, Insightful)
I quite like the feature in OS X (Score:3, Informative)
its not a problem for me (Score:5, Funny)
i can type my password without even looking
watch, i'll enter my bank account password without looking
fluffybunnies
see? i didn't even need to...
oh crap...
unsubmit
where's the damn unsubmit!
People are a problem (Score:4, Interesting)
A few weeks after opening, I had found out that a few people had not created accounts, because they had the strange idea that not having bullets somehow made the site less secure. That somehow, *I* would be able to see their password, more than if there were bullets.
Needless to say, I changed over my password fields to bulleted, because I didn't want to lose any possible members to such a stupid problem. I still think that plain text is better, but it has become mandatory security theater. Much like an SSL cert makes even the most questionable site legitimate, lacking bulleted passwords makes people think you're being sneaky somehow. It is sad, but it's reality.
Re:Not to fanboi all over the place... (Score:5, Informative)
Re: (Score:3, Insightful)
I think you confused an example of something with the attribution of something.
He said "the iPhone has this feature".
He didn't say "the iPhone innovated this feature".
Do you feel better now after your minute of Apple-hate?
Re: (Score:3, Informative)
I first saw it on Nokias S60 3rd edition, some 4 years ago; never had the occasion to try it on earlier S60s. It really is an extraordinary usability improvement, especially for keypads.
Note however, the Nokias don't enable the feature when you enter a numeric password (e.g. the PIN), so I don't think they meant it as a usability feature in the sense Nielsen wants, but simply to overcome the frustration of entering masked letters on a numeric keypad.
And it's quite obvious Apple didn't come up with the idea:
Re: (Score:3, Funny)
Re:As they say... (Score:5, Funny)
I say "good morning" to people in the morning. You know who else said that? Mussolini. Therefore...
Re: (Score:3, Informative)
than they can see your fingers type they characters of your password on the keyboard
Have you ever tried that? Unless you practice it a good bit you are quite unlikely to succeed, you also have to have a good stare at the keyboard which could be easily noticed by the user. Having the password clearly readable on the screen is a whole different matter. People are trained to recognize words quite literally in the blink of an eye. So any non-trivial password is very easy to spot when its written to the screen, even from a distance when you are not actually trying to read it you could spot it j
Re: (Score:3, Funny)
Re: (Score:3, Insightful)
That FTP IS stupid. They should switch to SFTP and require digital certificates to connect, so they can authenticate connections without compromising login credentials.