Stop Password Masking – say whaaat?

Short – Bad idea!

I just stumbled on couple of articles on this subject, and since Daemon and I recently discussed this subject in depth, seemed interesting enough to share our thoughts with our readers.

A month ago, my main man Daemon and I did some brainstorming in our office kitchen. At that time we just finished building one very interesting project which featured a little bit different login scheme for entrance to protected user section of the website. Can’t go into too much details, but it didn’t have usual username/password login box. No password fields for nasty robots to brute force, no typo errors. Daemon and I were confused by unsecureness and bedazzled by simplicity and ease of use of this login scheme. Before you all start removing password fields/masks from your login forms – stop, hammertime! The concept like this can only work if couple of very specific predispositions were met and on a very specific projects.

In current revision of the World we all share and information equals $, there is no way passwords and secrets will ever disappear. You just need to weight user experience on one side and value of your data on other and decide which login scheme works for your target population. When you need to make things more secure – remember – there is no such thing as too secure protection.

Daemon and I brainstormed about different approaches to user authentication in general and on the web. Among tons of silly ideas, some stud up:

• Unmasked password field. Easy to remember, can see what you type so you can correct it and avoid unreadable CAPTCHA harassing you. Fails if you are not alone in the room
• iPhone style passwords – password field is masked, only last typed char shows up unmasked for a moment then it becomes masked as well. This is nice twist between unmasked and masked passwords. Lowers typo errors, but also the security. Fails if somebody watches your screen. Somebody even made jQuery plugin for this.
• Replacement of password field with couple other of questions, some answers masked some unmasked. You don’t have to remember/type down/tattoo your 32 char password. Fails for people close to you or the ones with good detective skills.
• Keep the password field masked and change asterix (mask *) color to the input field background color so nobody can guess how many letters your password has. Haven’t tried this one yet, but many unix login prompts don’t have asterix replacement for typed in password letters and it works there like charm.

Similar read which encouraged me to write this down:

• useit.com – Stop Password Masking
• janko – Should we stop masking passwords?