News for hackers. Stuff that matters.
Re:Investigating the impact removing password masking has on... by donalhunt on Wednesday June 19, 2019 @06:15AM (#20222115)
2 comments:

1) This needs a [2014] tag.

2) This encourages password re-use and the 2019 guidance really needs to focus on generating unique passwords for each site / property and storing it somewhere secure. The push to move to other forms of security has never been stronger.

Re:Investigating the impact removing password masking has on... by abathur on Wednesday June 19, 2019 @11:16AM (#20224090)
I see the logic in point 2 and agree it's possible that this could be the net effect, but I think there's at least one more distinct possibility.

I use a good password manager with long, unique, random passwords.

The world is messy, though, and some small fraction of the apps/sites/devices/contexts I need to enter credentials stored in my password manager require manual entry. Some of these are on a device with the password manager, but fail to support auto-fill and block paste. Some of these are on other devices (such as TV streaming boxes). It also applies to every login I need to enter on a new device before my password manager is installed and unlocked.

When I have to enter dozens of high-entropy characters on mobile keyboards, TV remotes, or my sad 3rd-gen MacBook butterfly keyboard, a simple unmasking toggle is a lifesaver. Its absence is a misery/frustration multiplier. I'm not sure how the initial login on an iPhone is, but it took me 4 tries to log in on my newest Android because I had to enter ~40 characters while swapping between the stock alpha/symbol keyboards without an unmask.

I'm sold on the value of using a password manager and aware of the risks of not doing it, so these frictions won't deter me. But I'd be surprised if I'm in the majority, here. I suspect many people will fail into partial or complete non-compliance with the password manager if they regularly encounter these scenarios (or encounter them while the costs of abandoning the effort are still minimal).

Re:Investigating the impact removing password masking has on... by plibither8 on Wednesday June 19, 2019 @06:43AM (#20222197)
Just wondering, how does this encourage password re-use?
Re:Investigating the impact removing password masking has on... by jlmb on Wednesday June 19, 2019 @06:51AM (#20222229)
When using a password manager you don't need to ”check the input” or “correct an error” or “see what characters have been typed" (the only ”usability problems” mentioned in the article)
Re:Investigating the impact removing password masking has on... by ekzy on Wednesday June 19, 2019 @06:57AM (#20222253)
I think OP mean that if you use unique passwords, you would typically use a password manager and randomly generated passwords. You don't need to know so there is no point in seeing the password.

I don't think showing the password would actually encourage to re-use a password, but hiding the password may encourage to use a password manager and unique passwords.

Re:Investigating the impact removing password masking has on... by larrik on Wednesday June 19, 2019 @11:39AM (#20224289)
Password managers sound great until you buy your kids a Chromebook and they need to type in their secure password to log in every damn time.