I am very pro usability—anyone who knows me will agree. I fight the fights that need to be fought. I go against the corporate decisions that don't benefit the user. I evangelize for Donald Norman and hang on every word that Jakob Nielsen speaks. This is why it seems so very strange that I would be incited by an innocuously titled article, Stop Password Masking, on useit.com. Dr. Nielsen contends that we—Web developers—should abandon legacy design and stop providing "little dots" instead of the actual characters that a person is typing in for their password. On the surface, this seems to make sense. After all, it's hard to type in that which you can not see. I guess I should be upfront and say this is many years as a sys-admin speaking--not a usability expert—but none-the-less I found many things flawed with the post. I would add that the designers of systems have a responsibility to protect users from compromising their account. But the main point of the article is that by not showing users what they are typing when the type a password, we are decreasing the usability of the page and also the security of the page. Here is a brief recap of the main points of the article (please read the whole article for yourself):
There are very few times when a user is in actual danger of someone "seeing" what they are typing
Users make more errors when they can't see what they are typing
More errors means less confidence
All this leads to users using simple passwords or copy/pasting passwords
One of his primary points is that a "skilled criminal" can capture you password by looking at the keyboard, not the screen. It's hard for me to argue with this as I have witnessed this and even done it. Here's the rub...I have managed users on systems large and small for the better part of 20 years. I have learned by observation that people don't have simple passwords because passwords are hard to type in without seeing, they have simple passwords because they are easy to remember. As a system administrator I know, inherently, that the weakest chain in any system is the user. And it's not because it's hard for them to type their password, it's because they want one password that is easy to remember and is somehow tied in with who they are as an individual. For this reason, I find passphrases to be a better solution because they are easy to remember and are instantly harder to hack due to their length. If someone has a hint of what you like, they may more easily crack the passphrase with shoulder surfing, but it's much harder than a simple password. Lastly, Dr. Nielsen points out that we should abandon legacy design—I am a HUGE fan of abandoning legacy design when it makes sense. Dr. Nielsen points to both form reset buttons and password masking as being legacy design...as the twitteratie say, EPIC FAIL! Let's focus on usability, but only when usability is really the problem. But maybe you disagree with me, leave me a comment. blog comments powered by Disqus