8

In a GUI form, or for example a login box on a website, it's usual for masked characters to appear like ********* as you type out your password.

But in terminal applications, for example ssh, this is rare - it's usual just for the terminal to have echo off as the user inputs password.

Why this discrepancy? I'm of the opinion that the echo is just as useful on a tty as it is on a GUI. It gives you some visual feedback to your actions so you know the input is going somewhere, and if you accidentally bumped two keys you can notice it immediately and backspace appropriately.

2 Answers 2

6

I would say this post offers a good rational as to why many/most command line programs don't echo.

To summarize, it is normally much easier to disable echo, than replace the text, with command line programs.

6

Part of the commonly held belief by technical people is that not having an echo of * makes the password more secure as anyone watching over your shoulder is not aware of the password length - which they would be if they saw the number of * characters.

So whether or not the original reasoning were security, the fact that most users perceive not having an echo as a security benefit means that changing it is likely to be seen in a negative light by users, and would probably then be poor UX.

That aside, it's significantly simpler to disable the echo than it is to modify it to return a different character than the one that was entered. This very likely plays a role in why it isn't done, but has little to do with UX.

The user perception is the key here, and a perceived benefit is as good as a real benefit - especially when it comes to security.

3
  • A shoulder-surfer could equally well count the number of keyboard pressed audibly, or even visually, so I don't think there is really any security benefit there ..
    – wim
    May 17, 2013 at 8:29
  • 1
    @wim I never argued that it is a benefit, rather that it is a perceived benefit.
    – JohnGB
    May 17, 2013 at 8:55
  • 2
    @wim: thanks for introducing me to a new term: "shoulder surfing". Made my day. May 17, 2013 at 12:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.