Comments on: Terrible Password Security Advice From Jakob Nielsen

By: SayWhatMobius

SayWhatMobius — Tue, 11 May 2010 18:22:22 +0000

After reading Mobius’ reply, I am left scratching my head. Yet another example of someone who thinks they have a clue, yet really don’t. I would rather support 5k users locking their accounts out due to password mistakes rather than risk just one of them compromising their account by typing a password in during a presentation or similar. Supporting locked out accounts is better than trying to deal with compromised data, especially on an enterprise level.

That 100 hours you spent studying the web and security were wasted.

By: zithromax dosage

zithromax dosage — Thu, 24 Dec 2009 00:16:59 +0000

Valuable thoughts and advices. I read your topic with great interest.

By: Klaus Johannes Rusch

Klaus Johannes Rusch — Thu, 23 Jul 2009 07:55:48 +0000

The checkbox to reveal the password may be a reasonable compromise for those having difficulty typing passwords, but not as the default.

For Websites that don’t offer an option to reveal passwords (most) there are simple JavaScript solutions.

By: Pharrisee

Pharrisee — Fri, 03 Jul 2009 00:51:47 +0000

One thing to bear in mind with Jakob Nielsen is that unless he keeps finding usability issues his income stream shrinks pretty darn quick.

By: Twitted by sahate

Twitted by sahate — Tue, 30 Jun 2009 09:15:57 +0000

[...] This post was Twitted by sahate [...]

By: James

James — Mon, 29 Jun 2009 22:41:18 +0000

Most people are not getting what the real issue is. “Regular” folks leave their stickies laying around, type their password so slowly that an attacker wouldn’t even need a special “keyboard reading ability” to learn their password, lose their passwords every couple of weeks and flood support departments. This are the same people that wouldn’t cover their screens when they log in to a website. This are the same people that would probably leave their banking website on a browser on an unlocked workstation with the credentials on it. What’s the use of a checkmark to unmask a user’s password when most of the computer illiterates (read most people that use computers) of the world are simply gonna prefer seeing their passwords on screen not caring at all that someone may access their password because of it.

The real issue is that real users prefer to see their passwords because it’s more comfortable. They almost completely disregard security in behalf of not having to check their caps lock key (which by the way is a problem easily fixed by informing the user via a decent error message that it might be turned on) or retype their passwords. This same users save their passwords on a computer and then leave it unlocked where anyone can browse their history, log into one of their accounts and then wreck havoc. We can’t protect the user from all possible cases of wrongdoing, but using masking we do our best to avoid some of those cases.

While I’m going at it, most complains seem to come from people that have to deal with “support”. So instead of getting 50 calls a day, you get 200 calls because of stringent password policies. And you believe that its a waste of time, waste of money and waste of resources. So you want unmasked passwords so half your staff gets laid off and you go back to getting only 50 calls a day, but, alas, the problem with that is that now your calls are not about resetting passwords for people that forgot them. Now you get calls about people complaining that their passwords not only do not work, but someone wrote insults on all their friends facebook walls and made a banking transaction moving funds to some random account on a Cayman Islands bank.

If you have to deal with software security you need to cover your and the user’s ass. Why are you even thinking about making security comfortable? Let’s not search for bombs in airports, lets just let them blow stuff up. Let’s not stop and breathalyze potential drunk drivers, let them crash into schools. Let’s NOT put wet floor signs in the cereals isle, let the old lady break her hip when she falls. Let’s not protect the users in any way, since they prefer being on their own and it’s more comfortable for them not to listen to us.

Again, why are you even thinking about making security comfortable? It’s NOT. Get over it and do your job people… and do it correctly.

By: Wayne

Wayne — Mon, 29 Jun 2009 15:26:32 +0000

Reading many of these comments have an option to de-mask (default would be to mask) and this this option is never remembered so the user would have to click the box every time would help out many people. Working in an IT department that has to support password issues I doubt this would hurt security. A quick look around many offices and I can the sticky note with their passwords on it attached to their monitor, under their keyboard. A nice result of requiring complex passwords for different systems that have different password requirements and expire at different dates.

By: Jon

Jon — Mon, 29 Jun 2009 01:49:13 +0000

@William – please explain how Jakob’s bank account could be compromised just because he could now see his password as he enters it?

By: Matt Todd

Matt Todd — Sun, 28 Jun 2009 16:29:55 +0000

In my opinion, if they want to provide a way to have unmasked password fields, that’s fine, but make it the exception. Provide a masked password field and an option to turn off the masking, similar to how Apple handles logging onto wireless networks.

Alternatively, you could also take something similar to how Apple handles password entry on the iPhone by revealing only the last typed character and then masking it on the next keystroke or after a specific time (whichever comes first).

Either way, you get the benefit of unmasked passwords but the comfort and security of password masking.

By: Skeuomorph

Skeuomorph — Sat, 27 Jun 2009 19:43:03 +0000

@Dylan: “a configurable amount of plain-text “follow” when typing into a password field…”

This is how password fields work on the iPhone, so you have a momentary visual confirmation of using the correct key, without the insecurity of the whole password remaining revealed. In use it feels both natural and elegant.