I generally like the idea of providing users the choice to reveal their typed password; many apps and sites have done so over the years. However, I have no idea how the original idea of entirely removing the "password masking" passed the "shower thoughts" phase, let alone made it into an academic research project.
> How often is someone looking over your shoulder when you type a password?
When I'm in the privacy of my own home? Rarely. When I'm using a mobile device (arguably where "unmasking" provides the most usability improvement) in public? All the time. No, random strangers are most likely not paying attention to your phone, but look around next time you go out there are cameras _everywhere_.
Even the helpful mobile keyboard feature that shows you the last entered character is a risk. Not to mention merely watching the interaction with the onscreen keyboard. However, both of those require a moderate amount of attention, versus just prominently displaying the full password unobstructed all at once on the screen.
You may not think those cameras matter, but let's be honest, many people have access to the data feed through those cameras. From the near-minimum-wage "security" guard (or loss prevention) employee to the corporate security teams storing the backed up footage.
Logging into your Hacker News account may present a low risk, but certainly, this could be catastrophic when logging into your bank account. It's one of the less acknowledged benefits of fingerprint readers and password managers (combined). Unmasking that password entered by the password manager would defeat this entirely.
Let it be an option, but don't do this by default.
> How often is someone looking over your shoulder when you type a password?
When I'm in the privacy of my own home? Rarely. When I'm using a mobile device (arguably where "unmasking" provides the most usability improvement) in public? All the time. No, random strangers are most likely not paying attention to your phone, but look around next time you go out there are cameras _everywhere_.
Even the helpful mobile keyboard feature that shows you the last entered character is a risk. Not to mention merely watching the interaction with the onscreen keyboard. However, both of those require a moderate amount of attention, versus just prominently displaying the full password unobstructed all at once on the screen.
You may not think those cameras matter, but let's be honest, many people have access to the data feed through those cameras. From the near-minimum-wage "security" guard (or loss prevention) employee to the corporate security teams storing the backed up footage.
Logging into your Hacker News account may present a low risk, but certainly, this could be catastrophic when logging into your bank account. It's one of the less acknowledged benefits of fingerprint readers and password managers (combined). Unmasking that password entered by the password manager would defeat this entirely.
Let it be an option, but don't do this by default.