-12

Should it be way that the interaction is designed for password field in any web form or login page? Can it be the right way to showing total number of character of a password while user enters it?

Just a thought! for example

Showing first and last character (a**********g) Total number of characters (*******8*******) obviously the option of showing and hiding the character is available on existing interfaces (******show******)

While creating any account, a user can be asked to support his password with a imagery so that when s(he) forgets the password he may request to see the imagery and recall password.

This question came into my mind because i observed users do mistakes while typing passwords, user's pain of forgetting passwords frequently and following hectic password recovery process.

2
  • 3
    Is your question if it is good UX to give the user hints to the correct password? I think most people will feel very uncomfortable about the fact that people they know might guess their password (let alone that it makes it easier for hackers too). And probably that their password is stored unencrypted will also raise questions.
    – jazZRo
    Jun 28, 2015 at 12:50
  • 1
    You're right to think about this problem. Forgetting passwords, and mis-entering passwords is a common and frequent hurdle. It looks like the suggestion to partially reveal the password is worrisome to other respondents. I like the idea of showing an image—such as an image of an orange of a giraffe or a car—in an attempt to trigger the user's memory. In order to associate the image and the password, you'd have to show this image every time the password is entered. But wouldn't the website itself be the visual cue for remembering the password?
    – JeromeR
    Jul 26, 2015 at 20:09

2 Answers 2

2

Although following your suggestion of providing password information when entering a password may make it easier to get the right password (although this is still arguable), it comes at the cost of worse security.

If someone needs an easier to remember password, let them choose that, but by you revealing something about their password when entering, you essentially force them to use an even more secure password, which is even harder to remember.

An aspect of UX is keeping private information private, and simply giving any information about a password, makes it less secure and, in my opinion, hurts the UX far more than it helps.

TL;DR: Don't do this.

0

Well then.

This probably wouldn't be a great idea.

It would be easier to hack

If you did this at the start/middle/end of the word, it would take barely any time to brute-force the account. Basically, that means that the hacker could systematically use dictionary words until they found the correct one.

It's hard to implement

Also, your login form should be focused and simple and neat, and shouldn't have all sorts of weird features like this.

Users probably won't like it

Users are used to forgetting passwords, and they might be a bit confused/shocked/angry/scared if, on the forgot password page, it said the first letters of their password in large letters.

Users are also used to getting reset emails and immediately going to their inbox after pressing the reset button. If they were just faced with two letters and still couldn't know what it was, then they wouldn't be able to get in.

Example

Let's look at this from a user's point of view.

  1. You setup an account
  2. You want it to be very secure (of course)
  3. You've forgotten your password
  4. You can't remember it at all
  5. You do a password reset
  6. It then shows you the first and last letter of your password in large pink and purple letters
  7. You can remember your password now! Hurrah!

Now, let's look at this from a hacker's point of view.

  1. You find out about this website
  2. You see that the password reset shows you the first and last letter of your password in large pink and purple letters
  3. You then put the user's account username into the password reset
  4. Then, the letters are revealed
  5. You then get a robot to try out all the dictionary words starting with those letters
  6. You have then got access to the user's login details.

Now then, this would not be good. No it wouldn't.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.