Santhosh Tuppad's

While I refer to http://useit.com/ for usability related articles and I do recommend to many testers as well. However, I filter out which doesn’t make sense to me rather than following something blindly. Darren McMillan, a tester and my friend posted a tweet with the following URL http://www.useit.com/alertbox/passwords.html and after reading it, I felt most of the points did not make sense (At least to me). I responded to the tweets but, 140 characters were not enough to put my thoughts on Twitter which is why I thought of writing this blog post. Let the learning ride start now.

My comments for what Jakob Nielsen mentions in his article,

Jakob Nielsen says: “Typically, masking passwords doesn’t even increase security, but it does cost you business due to login failures.”

Santhosh Tuppad says: Security is not about making it fool-proof. It is about building layer by layer. Yes, it does increase security rather than not having masked password. It protects against shoulder surfing.

Jakob Nielsen says: “More importantly, there’s usually nobody looking over your shoulder when you log in to a website. It’s just you, sitting all alone in your office, suffering reduced usability to protect against a non-issue.”

Santhosh Tuppad says: I have seen many people even in office feel uncomfortable when someone is sitting beside them and they need to enter their password. It is because they feel they might look into the keyboard if their typing is slow. When they feel uncomfortable for this instance, will they not feel unsecured for showing the password without masking? I have seen my colleagues coming to my desk and asking for something. There have been instances when they came to my desk for something where I had to login to application and show them something. Now, do I need to ask them to turn that side and keep looking at them if they are watching me and then type my password?

I would say contexts are different, if you are sitting alone in your office in a separate chamber it’s different. But, remember that here we are dealing with the whole Web End-Users and not just hand-picked people.

Jakob Nielsen says: “Most websites (and many other applications) mask passwords as users type them, and thereby theoretically prevent miscreants from looking over users’ shoulders. Of course, a truly skilled criminal can simply look at the keyboard and note which keys are being pressed. So, password masking doesn’t even protect fully against snoopers.”

Santhosh Tuppad says: Well, by unmasking them you are giving chance even to any snooper rather than skilled ones. You are degrading the security here. Let me give a typical example which you can relate to: You have doors for your home and windows. Even windows could be used to by thieves to get in the house by breaking them. Now, it doesn’t mean you should remove doors because they can get in from window as well. I repeat: Security is about adding layers rather than saying FOOL PROOF security.

Jakob Nielsen says: “Password masking has proven to be a particularly nasty usability problem in our testing of mobile devices, where typing is difficult and typos are common. But the problem exists for desktop users as well.”

Santhosh Tuppad says: I partially agree to usability problem in mobile devices where the keypad is cumbersome while I disagree with desktop users – Yes, there have been times when we have typed it wrongly but, I personally have not found it as a usability problem. It is as simple as this; by mistake from bunch of keys I inserted some other key in the lock which did not open it. So, it doesn’t make sense to say “Let me not lock the door itself”.

Jakob Nielsen says: Users make more errors when they can’t see what they’re typing while filling in a form. They therefore feel less confident. This double degradation of the user experience means that people are more likely to give up and never log in to your site at all, leading to lost business.

Santhosh Tuppad says: I personally see password not being asked as a security vulnerability rather than seeing it from usability perspective. I have not seen end-user saying I will not login to this site because they mask the password. Well, password is secret and it has to be secured. If there is a website which doesn’t mask its password, then I would say it is a security bug rather than seeing it as a usability element.

Jakob Nielsen says: The more uncertain users feel about typing passwords, the more likely they are to (a) employ overly simple passwords and/or (b) copy-paste passwords from a file on their computer. Both behaviors lead to a true loss of security.

Santhosh Tuppad says: How does it help when password is unmasked? Still people will continue to use simple password which they can remember. This doesn’t make any difference. People having random passwords who want to copy paste will still continue even when password is masked or unmasked. It is important to remember that, technology provides one layer of security and other layer should come from individual awareness. I cannot complain that system is not securing my account while I wrote my password on some piece of paper and hacker got that piece of paper.

Jakob Nielsen says: Yes, users are sometimes truly at risk of having bystanders spy on their passwords, such as when they’re using an Internet cafe. It’s therefore worth offering them a checkbox to have their passwords masked; for high-risk applications, such as bank accounts, you might even check this box by default. In cases where there’s a tension between security and usability, sometimes security should win.

Santhosh Tuppad says: The checkbox idea might be employed given that by default password is masked. However; I do not agree where Jakob Nielsen mentions only about “high risk applications”. Why is there discrimination? Any application that has login feature is made with the purpose to protect the data.

Banking application by default should have masking feature for password? Why not others? You are putting masking feature by default that no one else should see it and you should not feel uncomfortable to continue with your work while someone is sitting beside you. Right? Then why do it only for some applications and leave others. Just like “iPhone is iPhone”, “Security is Security” and “End-user is end-user” irrespective what kind of application he / she is using.

Summary

In my opinion, it doesn’t make sense to say, “I will remove the doors to add usability, so people can not open the door lock and put efforts in it”. People can still get in by breaking the window or door but, it is layer of security which is same as “masked” password rather than removing it. I agree to some extent to the checkbox idea where you give a checkbox to unmask the password and show it as plain text to end-user however; by default it has to be masked. It is just like you are not checking “Remember Me” in option by default because of Security. Considering this password unmasking, then “Remember Me” should be checked by default to add usability which is not correct.

It is not security versus usability. It is about thinking how we can build applications with better security and better usability and not compromises on both of them to at least a certain level even if we cannot match both of these and there are contexts where I have provided solution so that there is no degrade of usability or degrade of security. It is not security must win and usability should lose and vice-versa (They are not contenders). There are always better ideas, what it needs is brainstorming. Usability is more of analysis and psychology rather than just concluding in few minutes or concluding by thinking as individual. I would finally like to add one point here – “If you are not masking the password then you are spoiling User eXperience and may be you can make end-users not login to your application because they feel uncomfortable logging in with plain text while someone is beside them.”

I hope you had a good read and happy learning.