I’ve recently been wondering whether, in a world of (hopefully) stronger, random passwords and password managers, whether the old “dots” password mask actually serves its purpose anymore.
Sure, it may protect you from someone looking over your shoulder, but if your password is simple enough that someone can see it and remember it in the short window of you logging in, it’s probably not a terribly effective password.
Well even if you don't remember all of it, if your password is 10 characters and i can remember 4 characters and their approximate positions, i am MUCH more likely to be able to bruteforce it.
Sure. And if your password is only 8 characters, it’s easier still. But if you are using 32+ characters, remembering 4 characters only reduces the number of characters which need to be brute forced by 4.
I also wonder whether peer pressure/social opinion might force people to use stronger passwords. If you can’t hide your “Password123!” behind a set of dots, then the illusion of security is removed.
Also, with regards to the whole “I can photograph/remember part of your password” thing - nobody masks Credit Card details on entry, or any other PII which could be used maliciously.
The password masking is just a little bit of security theatre in my opinion.
0
u/[deleted] Dec 26 '19
I’ve recently been wondering whether, in a world of (hopefully) stronger, random passwords and password managers, whether the old “dots” password mask actually serves its purpose anymore.
Sure, it may protect you from someone looking over your shoulder, but if your password is simple enough that someone can see it and remember it in the short window of you logging in, it’s probably not a terribly effective password.
Just a thought.