1: what purpose do the stupid asterisks serve, anyway? I understand them on an ATM machine, but not on my desktop PC or phone.
2: Very frequently (like, maybe 50% of the time) when trying to type a password on my phone, I miss the little "key" and mistype, but can't see that I did. I have to make multiple tries at entering the password. This feature would prevent that.
So it looks like all upside, with no cost (when used only in appropriate contexts).
1. Shoulder surfing a password is way easier than other forms of cracking. Sure, you might not think people are looking at you as you type your password, but then this becomes a crime of opportunity...
2. There are technological ways around this, like finding a bigger keyboard for your phone, using password management software, imploring the website to make an app, practicing typing, etc. Also, BB/iOS/Android all show the most recent character you typed in a password field. Many soft keyboards give feedback about the most recent character you types as well.
I'm fine with my password fields being obfuscated.
I agree that this feature is good while working with a smartphone, but I'm pretty sure Android has a settings somewhere to always show the last letter you typed in every password field. I would be surprised if there wasn't a setting for that also on iOS.
The thing is, I think it makes perfect sense to implement this in certain situations, but at an OS or browser level, not in the website or inside an application. Passwords are something we have grown used to and we always expect them to behave the same way! If we were to change the way passwords are handled, it should be consistent across everything.
For example, browsers could implement password fields with a checkbox next to it that lets you show/hide password at your will. The fact that this website has only one setting (always show when in focus) is scaring me.
> "I would be surprised if there wasn't a setting for that also on iOS."
That's the default behavior for password fields in iOS.
Trick is, when you have a long password it takes far too long to shift focus from the keyboard to the text field to verify each character before moving on.
I'd very much like to have a client-side show/hide button for password fields.
1: what purpose do the stupid asterisks serve, anyway? I understand them on an ATM machine, but not on my desktop PC or phone.
2: Very frequently (like, maybe 50% of the time) when trying to type a password on my phone, I miss the little "key" and mistype, but can't see that I did. I have to make multiple tries at entering the password. This feature would prevent that.
So it looks like all upside, with no cost (when used only in appropriate contexts).