The “Cobra Effect” that is disabling paste on password fields

Re:The “Cobra Effect” that is disabling paste on password fi... by foxylad on Monday June 27, 2016 @12:22AM (#11984201)

This raises the interesting question of why we obscure the input when changing passwords. Showing the new password would allow people to check and correct it, so you'd only need one input.

Given that the contents of a password input can easily be revealed, the only security obscuring the input provides is from an attacker who can see the screen but not the keyboard, and has no physical access to the device - a pretty limited threat pool.

I guess the answer is that users expect passwords to be hidden. So we make their lives more difficult purely to keep them happy.

[ Parent | on HN ]

Re:The “Cobra Effect” that is disabling paste on password fi... by Frank2312 on Monday June 27, 2016 @08:42AM (#11985757)

IE/Edge have at least one thing good about them : you can click on a little eye icon to the right of the obfuscated field to reveal the text in the field until you release the mouse button.

[ Parent | on HN ]

Re:The “Cobra Effect” that is disabling paste on password fi... by a13xb on Monday June 27, 2016 @05:15AM (#11984988)

I think the original intent of obscuring input password is to counter shoulder surfing.

[ Parent | on HN ]

Re:The “Cobra Effect” that is disabling paste on password fi... by kevincox on Monday June 27, 2016 @02:58PM (#11988546)

Showing the password can be nice in situations but I doubt I would catch most typos but re-reading my password. My eyes often see what my brain expects to see.

[ Parent | on HN ]