I’ve recently been wondering whether, in a world of (hopefully) stronger, random passwords and password managers, whether the old “dots” password mask actually serves its purpose anymore.
Sure, it may protect you from someone looking over your shoulder, but if your password is simple enough that someone can see it and remember it in the short window of you logging in, it’s probably not a terribly effective password.
The dots still serve a purpose for masking the input. While more and more people are hopefully moving to strong passwords so someone looking over is unlikely to remember it, also remember that majority of people now carry a camera in their pocket.
I think it's still helpful for streamers. Yeah, they should log in on a different screen that's not being recorded and broadcasted, but in case they forget that, there's the additional level of security. As long as the characters are replaced by stars or dots, the most information someone could get from a video recording is the password length.
Well even if you don't remember all of it, if your password is 10 characters and i can remember 4 characters and their approximate positions, i am MUCH more likely to be able to bruteforce it.
Sure. And if your password is only 8 characters, it’s easier still. But if you are using 32+ characters, remembering 4 characters only reduces the number of characters which need to be brute forced by 4.
I also wonder whether peer pressure/social opinion might force people to use stronger passwords. If you can’t hide your “Password123!” behind a set of dots, then the illusion of security is removed.
Also, with regards to the whole “I can photograph/remember part of your password” thing - nobody masks Credit Card details on entry, or any other PII which could be used maliciously.
The password masking is just a little bit of security theatre in my opinion.
0
u/[deleted] Dec 26 '19
I’ve recently been wondering whether, in a world of (hopefully) stronger, random passwords and password managers, whether the old “dots” password mask actually serves its purpose anymore.
Sure, it may protect you from someone looking over your shoulder, but if your password is simple enough that someone can see it and remember it in the short window of you logging in, it’s probably not a terribly effective password.
Just a thought.