Yet again, while on a click-happy streak, I chanced upon some interesting concepts that took me back to an article I had read quite recently—Jacob Nielsen’s post on why we should stop masking passwords in web forms. Before looking at the experiments, let me try to summarise the idea that these are inspired by. Jacob Nielsen’s main reasoning behind his statement was:

Usability suffers when users type in passwords and the only feedback they get is a row of bullets. Typically, masking passwords doesn’t even increase security, but it does cost you business due to login failures.

He noted two interesting problems with the password fields

• Masking raises scope for error, makes people less confident and discourages people from trying your services.
• Makes it likely that people use less secure passwords or less secure mechanisms to manage multiple passwords

I agree with the case he presents, but find it hard to agree with his solution of just unmasking the password field and showing the passwords in plain text. He does recognise the risks associated with this and offers a solution:

It’s therefore worth offering them a checkbox to have their passwords masked; for high-risk applications, such as bank accounts, you might even check this box by default

Some of my notes on this:

• many users will not take that extra step of masking their passwords if it’s not masked by default and thus they would depend on the application creators to pre-empt how critical the security at this point is
• many users use the same passwords for their high-risk as well as low-risk applications (masking only high risk applications wouldn’t ensure security)
• a checkbox in a form usually conveys an input and runs the risk of confusing the users

But still, the thought that masking passwords is not such a smart solution holds strong. Related to this I found two interesting experiments by Chris Dary (arc90).

HashMask

visualizing a hashed representation of the password as a sparkline with color – the intent being that the user would become familiar with this image and be able to easily confirm that they typed the right (or wrong) password.

HalfMask

obscuring the password with semi-visible random characters in the background. The intent is to only allow the user who typed the password to easily read it

Both very interesting ideas—not there yet though.

Usernames and passwords present too much work:

• remembering too much information (website, username & password)
• retrieving the correct set of information
• counteracting human error

The problem though is, making it easier and more secure to authenticate needs to be done with a lot of caution—because easier (and automated) authentication raises much larger risks IMO.