Schneier- Password Masking

[Netwörkheäd]

Password Masking

Slashdot asks if password masking -- replacing password characters with asterisks as you type them -- is on the way out. I don't know if that's true, but I would be happy to see it go. Shoulder surfing, the threat is defends against, is largely nonexistent. And it is becoming harder to type in passwords on small screens and annoying...
   
   

Slashdot asks if password masking -- replacing password characters with asterisks as you type them -- is on the way out. I don't know if that's true, but I would be happy to see it go. Shoulder surfing, the threat is defends against, is largely nonexistent. And it is becoming harder to type in passwords on small screens and annoying interfaces. The IoT will only exacerbate this problem, and when passwords are harder to type in, users choose weaker ones.

Source: Password Masking

[dlots]

I think it should be optional, I do way to much skype/webex stuff to want to take away password masking.

Personally I would prefer a 2 factor auth method, a simple password and hit an app built into the browser that puts in the 2ed part of the authentication.

[deanwebb]

When I type in a complicated password and make a mistake on the 21st of 24 characters, I can never be sure it was EXACTLY that character... so I have to backspace back to the start and try again. Being able to see my password would be great there.

On the other hand, screen shares with vendor TAC... do I need them to see my passwords? No. I do not. Keep the bullets over the characters, there. Also, there are programs where one guy enters a password for a system account to use, but the other admins of the system are not allowed to know that password. Another reason to keep the bullets.

[icecream-guy]

in winders one can setup hot keys,  create hot key with the first 24 characters of your pass phrase, then you can manually type in the last 8.
just make the hot key come crazy combination?

[Otanx]

Just do the masking like it is done for wifi on Windows. By default it is masked as you enter it. Then there is a check box right below the text box that says "show text". Have the best of both.

-Otanx