14

Frequently, sites that should really value security (especially banks) ask for several individual characters from a password.

Typically I've seen them do it like this:

mockup

download bmml source – Wireframes created with Balsamiq Mockups

Is there a better way?

Improve this question
8
  • 4
    From a UX point-of-view it's not a bad way of doing it, but from a security perspective you'd be better off having dropdowns for each letter. The reason for this is because if there is a keyboard logger / spyware installed on the machine you can't track what letters get entered if it's from a drop-down. However if it's free text then those entries can be logged (which is why, as far as I'm aware anyway) that banks offer this as dropdowns and not free-text.
    – JonW ♦
    Apr 1, 2013 at 19:27
  • 27
    @JonW From a security perspective, I'd call this a red flag that they're using reversible encryption instead of hashing - not a very secure way to store passwords.
    – Izkata
    Apr 2, 2013 at 3:30
  • 12
    Don't. Ask at security.stackexchange.com why. (Basically what @Izkata said, but I bet one of the Thomases there will give you an awesome answer - the point is, noone but YOU should know your password, and if you forgot it it should be reset not retrieved)
    – Tobias Kienzler
    Apr 2, 2013 at 8:04
  • 3
    To those who are wondering why any site would do this, keep in mind that this is usually (always?) done when there are TWO passwords. First, a secure password used in the normal way and a secondary password where only certain letters are need. The reason for asking for only some letters of the second password is to thwart KEYSTROKE LOGGING as different letters of the password are asked for each time.
    – user27478
    Apr 2, 2013 at 10:23
  • 2
    @TobiasKienzler: I asked that exact question on security.SE almost two years ago! security.stackexchange.com/questions/4830/… I was rather hoping this question would focus more on UX.
    – alexmuller
    Apr 2, 2013 at 12:20

6 Answers 6

Reset to default
2

My solution would be to complete the login process in two steps.

  • Ask the user for the username, which if correct
  • Generate the password field asking for only password on the next screen.

enter image description here

Improve this answer
3
  • 8
    The problem is in order to validate certain characters, the password would need to be stored in, essentially, plain text which is a very bad idea.
    – Marcel
    Apr 2, 2013 at 8:49
  • 4
    I dont like this because it is easier for an attacker to find a username. If you need to input the combination and give a message "wrong username or password" the attacker doesnt know if he found a correct username.
    – Robert Niestroj
    Apr 2, 2013 at 8:49
  • Ah! I should've mentioned in my answer that this is what Hargreaves Lansdown do. They require your username and DOB before showing the password screen. Thanks for being on the ball!
    – alexmuller
    Apr 2, 2013 at 12:21
11

Jumping in with an answer because I've seen a really nice example of this in the wild. Hargreaves Lansdown is a UK financial institution, and here's how they do it:

Password input screenshot with context

The idea of giving context to a user hadn't occurred to me before I saw this. In practice, I find it far faster and easier to input a password when I can see how far the requested characters are from each end.

Improve this answer
4
  • 7
    It might be more usable, yes, but it does give away useful details about the password - the length of it. Knowing the length of a password removes some of the security aspect of it.
    – JonW ♦
    Apr 1, 2013 at 19:25
  • 10
    How do they store a password securely and also validate this?
    – JohnGB ♦
    Apr 1, 2013 at 20:10
  • @JohnGB: I asked exactly that on Security.SE security.stackexchange.com/questions/4830/…
    – alexmuller
    Apr 1, 2013 at 20:41
  • 4
    @alexmuller If someone were to get hold of the HSM key, everything may as well be plain text. That's not secure to me. Another good answer to this issue: stackoverflow.com/questions/8226887/…
    – JohnGB ♦
    Apr 1, 2013 at 21:03
9

If any service can validate what the n-th character of your password is, it means that they are storing your password in an insecure format. No service should ever know what your password is, they should only be able to say whether your password authenticates or not.

So you shouldn't ever ask for the n-th character of a password, and you shouldn't ever be able to evaluate whether this is the correct character or not.

If you want to authenticate someone, you should use a full password stored in a secure way.

Improve this answer
7
  • 5
    For bank websites this isn't the only form of security. My own bank requests a unique user ID and password when you first log in, and only on successfully getting past that stage are you then prompted to enter characters from your password (which is a different password to the one used to log in).
    – JonW ♦
    Apr 2, 2013 at 8:41
  • @JonW From a UX perspective, what is the benefit of now requiring someone to remember two passwords?
    – JohnGB ♦
    Apr 2, 2013 at 9:42
  • 1
    Well it does not have to mean they store the entire password in an insecure format. Maybe they just store the 4th, 7th & 13th letter of the password reversible. But it does decrease entropy, which undisputedly is bad.
    – Konerak
    Apr 2, 2013 at 9:44
  • 1
    @JohnGB: Well my assumption would be that people using online banking would not only put up with additional security requirements but would also expect it to some extent. If it's as easy to log onto my Twitter account as it is to log into my bank then (to me at least) I'd feel a bit less secure. There's probably a happy medium in there though - the more security the greater the annoyance, but too little results in lack of trust.
    – JonW ♦
    Apr 2, 2013 at 9:52
  • @Konerak If they store those letters, it means that part of the password is stored insecurely.
    – JohnGB ♦
    Apr 2, 2013 at 9:54
9

HSBC uses a combination of a username, password, and security key.

In this implementation, you first enter your username.

Next, you are prompted to enter your password and three random characters from your security key:

mockup

download bmml source – Wireframes created with Balsamiq Mockups

The benefit of this approach is that the password does not need to be stored in an insecure state. The interface also does not tell an unauthorized person the length of the security key.

By including disabled text boxes in the interface for the chars not requested, the user can more easily "spell out" their word and provide the correct letter without having to internally visualize the key's individual chars.

The implementation in the question has a much higher cognitive load because the user has to visualize the word and then count places to get the character.

Improve this answer
1
  • 2
    This is a great design, because it allows users who memorise passwords as paths across the keyboard (e.g. 'Qwertyuiop') to execute the password action without having to work out which letter falls at which position.
    – Jimmy Breck-McKye
    Apr 2, 2013 at 0:20
6

You should ask for the entire password, not just because it is more secure, but because users entire passwords by muscle memory, especially passwords made up of arbitrary characters, or defined by movements across the keyboard. This makes it hard for users to recall characters in specific positions.

Improve this answer
1
  • I totally agree. Asking for individual characters of a password is a ridiculous idea!
    – devios1
    Apr 4, 2013 at 22:39
2

I would use a dropdown here. Using a regular dropdown still allows keyboard input to quickly select the correct character yet makes it easier for users on touch-keyboards and those who prefer to use their mouse.

Improve this answer
2
  • Would the drop down need to have a value for every valid char per password policy including upper case, lower case, and special chars like !, @, #, $, %, ^, etc.?
    – Charles Wesley
    Apr 1, 2013 at 20:27
  • That depends on your password requirements.
    – user12741
    May 22, 2013 at 14:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.