Everyone does it … but just like jumping off a cliff, that doesn’t mean that you should too! We’re talking about password masking – having a little row of dots come up instead of the actual password when someone is trying to log into a site or service. I have yet to see a website that doesn’t use password masking, and haven’t actually heard before that it has a negative effect on internet marketing … but Jakob Nielsen, web usability guru, recently drew attention to the problems it can cause for some readers. Today we check out both sides of the argument
Masking - can it be used for good as well as evil?
What’s the problem with masking?
Well, if you use the same password for everything, and it is all in lower case letters with no special characters, capitals or numbers, then it usually isn’t a problem.
However, as password cracking becomes more common and hackers get increased access to computers around the world, people increasingly have quite complex passwords, which vary for different sites. If people get a password wrong three times and are kicked off your site, it certainly isn’t good for business!
Also, as mobile devices with tiny keypads matched with big fingers become more common, so do password errors and the resulting frustration.
What’s the alternative?
Personally, I see two alternatives. One is to simply remove masking altogether, and this is the option that Jakob Nielsen recommends. This would leave your password up on the screen for anyone to glance at and see … I don’t believe that it is just as easy to see what someone is typing by looking at their fingers, as to look at a screen and notice what they’ve typed. This would mean that using a computer in a public space would be extremely limited … or extremely unsafe.
The other option would be to routinely build a ‘Mask’ button into the login page of every website that uses a password, so people could turn masking off when they are in a private space, or on when they are in public. As with many of the best things in life … this is unfortunately NOT free!
Which would be the better option?
I honestly believe that a large proportion of web users would be LESS comfortable without password masking. Please feel free to correct me in the comments if that is the case.
While it is not currently a ‘done’ thing, I also believe that giving users the option to mask or unmask, or creating software that can automatically mask passwords to install on public computers, while websites themselves remain masking-free, are the ultimate solutions.
It is certainly time to challenge the norms … but with new ideas, not just ‘the stuff we used to do’.
