Re:Investigating the impact removing password masking has on...
by abathur on Wednesday June 19, 2019 @11:16AM
(#20224090)
I see the logic in point 2 and agree it's possible that this could be the net effect, but I think there's at least one more distinct possibility.
I use a good password manager with long, unique, random passwords.
The world is messy, though, and some small fraction of the apps/sites/devices/contexts I need to enter credentials stored in my password manager require manual entry. Some of these are on a device with the password manager, but fail to support auto-fill and block paste. Some of these are on other devices (such as TV streaming boxes). It also applies to every login I need to enter on a new device before my password manager is installed and unlocked.
When I have to enter dozens of high-entropy characters on mobile keyboards, TV remotes, or my sad 3rd-gen MacBook butterfly keyboard, a simple unmasking toggle is a lifesaver. Its absence is a misery/frustration multiplier. I'm not sure how the initial login on an iPhone is, but it took me 4 tries to log in on my newest Android because I had to enter ~40 characters while swapping between the stock alpha/symbol keyboards without an unmask.
I'm sold on the value of using a password manager and aware of the risks of not doing it, so these frictions won't deter me. But I'd be surprised if I'm in the majority, here. I suspect many people will fail into partial or complete non-compliance with the password manager if they regularly encounter these scenarios (or encounter them while the costs of abandoning the effort are still minimal).
I use a good password manager with long, unique, random passwords.
The world is messy, though, and some small fraction of the apps/sites/devices/contexts I need to enter credentials stored in my password manager require manual entry. Some of these are on a device with the password manager, but fail to support auto-fill and block paste. Some of these are on other devices (such as TV streaming boxes). It also applies to every login I need to enter on a new device before my password manager is installed and unlocked.
When I have to enter dozens of high-entropy characters on mobile keyboards, TV remotes, or my sad 3rd-gen MacBook butterfly keyboard, a simple unmasking toggle is a lifesaver. Its absence is a misery/frustration multiplier. I'm not sure how the initial login on an iPhone is, but it took me 4 tries to log in on my newest Android because I had to enter ~40 characters while swapping between the stock alpha/symbol keyboards without an unmask.
I'm sold on the value of using a password manager and aware of the risks of not doing it, so these frictions won't deter me. But I'd be surprised if I'm in the majority, here. I suspect many people will fail into partial or complete non-compliance with the password manager if they regularly encounter these scenarios (or encounter them while the costs of abandoning the effort are still minimal).