Pass­words have barely evolved since the early days of com­put­ing and are taken for granted in our daily online-lives. It’s time for change, says usabil­ity expert Jakob Nielsen, who believes pass­word mask­ing goes against basic usabil­ity prin­ci­ples and should be stopped (via Kot­tke).

Pro­vid­ing feed­back and visu­al­iz­ing the system’s sta­tus have always been among the most basic usabil­ity prin­ci­ples. Show­ing undif­fer­en­ti­ated bul­lets while users enter com­plex codes def­i­nitely fails to comply.

Most web­sites […] mask pass­words as users type them, and thereby the­o­ret­i­cally pre­vent mis­cre­ants from look­ing over users’ shoul­ders. [How­ever], there’s usu­ally nobody look­ing over your shoul­der when you log in to a web­site. It’s just you, sit­ting all alone in your office, suf­fer­ing reduced usabil­ity to pro­tect against a non-issue.

Nielsen sug­gests that pass­word fields should be plain­text by default, with a check­box avail­able for when a user would like to turn mask­ing on. Ignor­ing the usabil­ity issue of adding a new and unex­pected item to a form, and ignor­ing the social ram­i­fi­ca­tions of such a change (explic­itly dis­play­ing lack of trust by turn­ing mask­ing on around friends), do lengthy, sup­pos­edly ‘strong’ pass­words increase online secu­rity any­way? (pdf, via Schneier)

Strong pass­words do noth­ing to pro­tect online users from pass­word steal­ing attacks such as phish­ing and key­log­ging, and yet they place con­sid­er­able bur­den on users. Pass­words that are too weak of course invite brute-force attacks. How­ever, we find that rel­a­tively weak pass­words, about 20 bits or so, are suf­fi­cient to make brute-force attacks on a sin­gle account unre­al­is­tic so long as a “three strikes” type rule is in place. Above that min­i­mum it appears that increas­ing pass­word strength does lit­tle to address any real threat.

Secret ques­tions aren’t much bet­ter, either.