If all of those passwords were plaintext, then even assuming that it would become the norm to look away entirely (a’la PIN numbers) it wouldn’t be hard to find passwords.

When it’s my bank PIN I actually feel better knowing that they’d have to physically mug me for my card – a step I’d say few would take – rather than the “safer” stealing of a password to, for example, my bank.

Sorry Nielsen, you’ve got it wrong this time – a little too long spent in a posh office, I suspect.

http://irec.wordpress.com/2009/07/08/5-properties-of-passwords-that-must-be-managed-to-reduce-risk/

This actually improves security because I’d NEVER have to write my password on a sticky-note!

Now, THAT would be really user-friendly.

On a more serious note, are the masses (users) clamoring for an end to password masking? I think its something we’ve all learned to live with, and usually don’t give a second thought.

I would prefer a compromise where I can select, via a checkbox, whether the password I am about to type, should be visible or obfuscated.

If on trivial sites I choose a password of “becauseisayso” or “justdoit” and I want to be sure that I’ve not mistyped it (as opposed to mis-remembering which common password I provided to this site) then seeing what I type could be useful. Similarly, when I am in a secure environment, when I log onto a “serious” site/application/etc, I may prefer to visually confirm that I actually *did* type my password (‘f*^30-{]p”1d9pe’, since you ask) correctly before I press “submit”, especially if (this being an ultra-secure site) I would be locked out completely if I get it wrong.

So there are pros and cons to both approaches.

Somewhere, someone mentioned the Lotus Notes approach of obfuscaion: The first character is “*”, the 2nd is “**”, the third is “***” etc. That really does not help anybody!