Take the 2-minute tour ×
User Experience Stack Exchange is a question and answer site for user experience researchers and experts. It's 100% free, no registration required.

In a GUI form, or for example a login box on a website, it's usual for masked characters to appear like ********* as you type out your password.

But in terminal applications, for example ssh, this is rare - it's usual just for the terminal to have echo off as the user inputs password.

Why this discrepancy? I'm of the opinion that the echo is just as useful on a tty as it is on a GUI. It gives you some visual feedback to your actions so you know the input is going somewhere, and if you accidentally bumped two keys you can notice it immediately and backspace appropriately.

share|improve this question
add comment

2 Answers

Part of the commonly held belief by technical people is that not having an echo of * makes the password more secure as anyone watching over your shoulder is not aware of the password length - which they would be if they saw the number of * characters.

So whether or not the original reasoning were security, the fact that most users perceive not having an echo as a security benefit means that changing it is likely to be seen in a negative light by users, and would probably then be poor UX.

That aside, it's significantly simpler to disable the echo than it is to modify it to return a different character than the one that was entered. This very likely plays a role in why it isn't done, but has little to do with UX.

The user perception is the key here, and a perceived benefit is as good as a real benefit - especially when it comes to security.

share|improve this answer
    
A shoulder-surfer could equally well count the number of keyboard pressed audibly, or even visually, so I don't think there is really any security benefit there .. –  wim May 17 '13 at 8:29
1  
@wim I never argued that it is a benefit, rather that it is a perceived benefit. –  JohnGB May 17 '13 at 8:55
    
@wim: thanks for introducing me to a new term: "shoulder surfing". Made my day. –  Marjan Venema May 17 '13 at 12:46
add comment

I would say this post offers a good rational as to why many/most command line programs don't echo.

To summarize, it is normally much easier to disable echo, than replace the text, with command line programs.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.