Masking is a technique by which the data is blocked from the user's view point, but not from the data that's transmitted. So masking prevents "shoulder surfing" - someone looking over your shoulder while you key in your date of birth, Social Security number or account number.
Q: Did I key it in correctly?
A: I don't know - I can't tell.
Q: Now that after I've entered my SSN, it's asking me to enter it again -- and the second time I have to key it in, it's all bullets, too. Did I enter that correctly?
A: About as correctly as I entered the first one -- I guess.
Q: Do I feel more safe and secure?
A: Maybe?? No, not really. I feel more annoyed.
I do this every day when I enter my passwords. But here it just feels... odd. Why? Here are a few points to consider before masking these supposed toxicities.
1. Instant masking can frustrate users and cause errors. It prevents shoulder surfing in public areas, but is useless when the user is alone. Worse than being useless, it hinders users from seeing what they have keyed in - effectively placing a blindfold on the user. There are movements within the Usability field to eliminate masking altogether.
2. Keying in all numbers is not as easy as keying in passwords. Passwords are memorized, short and contain mostly letters - which most people can do without looking at the keyboard. Dates, account numbers and SSNs are NOT keyed in often and can cause users more errors in typing. A good user experience seeks to prevent errors before they happen. That's Jakob Nielsen, if you're interested.
3. A quick overview of Chase.com, Nationwide.com, Huntington.com and Schwab.com reveals that NO ONE is using masking in form sign-up information and no one is providing a verification field for SSNs or date of birth fields. If none of the leading banks, insurance companies or investment firms are doing it, there might be a good reason for it.
4. You'll make the user repeat himself in a verification field. Having to key in everything twice never sets well with users. And forcing them to do it blind - twice - is a super bad idea. It's another chance to make a typo on top of working blind in the first field. And which field - the first or second - has been mistyped? The mere fact that you will need to add a verification field for a masked input field is like screaming "We know this is a bad idea, but we're going to do it anyway!"
5. Masking can cost users and companies time and money. If the user has to bother an online specialist to get a password back, both the user and the company pay. Leaving the password field unmasked means users can easily correct their errors. See Jakob Nielson's article on password masking.
So to answer my own question, masking features is bad for both users and companies. Of course, some people may try to sign up for online sites in public places. But most of us do that sort of thing in a trusted area, anyway. As a user, I'm more worried about the guy who is downloading my data straight from the server. Masking doesn't help with a person's security as much as make a few people feel more secure -- if they are banking at Panera. By the way, that's a bad idea, too.
Solutions:
OK, so what if your company wants to do it regardless of your dire warnings? I was in that situation. I wasn't holding the purse strings nor did I have enough influence to make the project die. What then?? I came up with three solutions. Let me know if you come up with more.
1. If the SSN field must be masked, allow the user to see all numbers while keying it in and then mask the number AFTER the user tabs to another field. That way the user gets a good look at it before it's masked. It also eliminates the need for a verification field.
2. Allow the user to select a check box or button that would show the number instead of masking it. This is a second-class solution because the user is forced into take an extra step to be able to see what s/he has keyed in.
3. Showing the number for a split second works well on all mobile devices, but is less accepted for computer browsers. My IT friends tell me it's not a reliable solution for computers. But if you're on a mobile device, you're set.
Let me know if you have other ideas!
So to answer my own question, masking features is bad for both users and companies. Of course, some people may try to sign up for online sites in public places. But most of us do that sort of thing in a trusted area, anyway. As a user, I'm more worried about the guy who is downloading my data straight from the server. Masking doesn't help with a person's security as much as make a few people feel more secure -- if they are banking at Panera. By the way, that's a bad idea, too.
Solutions:
OK, so what if your company wants to do it regardless of your dire warnings? I was in that situation. I wasn't holding the purse strings nor did I have enough influence to make the project die. What then?? I came up with three solutions. Let me know if you come up with more.
1. If the SSN field must be masked, allow the user to see all numbers while keying it in and then mask the number AFTER the user tabs to another field. That way the user gets a good look at it before it's masked. It also eliminates the need for a verification field.
2. Allow the user to select a check box or button that would show the number instead of masking it. This is a second-class solution because the user is forced into take an extra step to be able to see what s/he has keyed in.
3. Showing the number for a split second works well on all mobile devices, but is less accepted for computer browsers. My IT friends tell me it's not a reliable solution for computers. But if you're on a mobile device, you're set.
Let me know if you have other ideas!
Interesting perspective, I can see where somethings might be a usability concern. But there is always a trade off between security and convenience. Personally I despise sites that blatantly shun standard security practices. Most of these are unrelated to your topic, but included lack of SSL, lack of proper password hashing (Any site that can email you your password or limits the characters you can use is for sure not hashing correctly). But in regards to your post I expect any private data to be hidden. I define private data as something that is not available to the public. For example this would include SSN and passwords but not birth dates. Your birth certificate is public record and can usually be queried online for sure, if not at the county board of health for sure. There is a concern more so than "shoulder surfing" as well. There is known malware in the wild that will take images of your computer screen and relay them somewhere (Of course those might include key loggers, which obfuscation won't help).
ReplyDeleteSo in summary my personal opinion is any site that does not take simple steps to conceal my private information is garbage, it is not safe to simply assume users will always be entering information in the privacy of their home.
Nice write up though, look forward to more!
Hey Jeremy - thanks for the reply. The whole malware taking pictures of your laptop sounds awfully inefficient. It seems like more sophisticated hackers would not take the time to do this. True?
DeleteI'm curious about your last paragraph, too - what are the "simple steps to conceal my private information"? How far do you go? Are the sites I mentioned - Schwab, Nationwide, Chase, Huntington - not going far enough by not masking SSNs and DOBs?
Well I view anything that is not public record as sensitive, so that means SSN is sensitive, but DOB is not since I can obtain that from public record (Many of these are even available to query online).
DeleteAs for malware taking screen shots many of the state sponsored attacks (the most sophisticated ones out there) like flame and stuxnet are capable of grabbing screenshots. Also I believe that there was a variant of the Zeus trojan that used screen shots to circumvent captia. they were the man in the middle and after you typed the captia it would screen grab so that that could be relayed quickly to the server so the server could quickly enter your account and perform transactions and feedback the site to you as if nothing was wrong.
As far as the sites that you mention, I do not do business with those that you have listed =P
http://i.kinja-img.com/gawker-media/image/upload/t_original/19dy99mrz4tjzjpg.jpg
ReplyDeleteHere's an interesting infographic with some best practices.