Post by @hakfoo@mstdn.party

2025-05-30 00:20 UTC

@neilsardesai@mastodon.social Weren't there some systems (I'm thinking Lotus Notes) where the masking for the password field was made of glyphs derived from the keys already pressed? This was a sort of accessibility hint-- if you saw the *pattern* you were used to you know you didn't drop or double a keystroke, even if it didn't provide visibility for the raw data. You could like sha256 the content of the field, then map the result onto a collection of emoji, for a similar effect.

Replies (7)

@neilsardesai@mastodon.social 2025-05-30 01:16

@hakfoo@mstdn.party Never seen that before but that sounds pretty fun!

Open ##2987164
@FritzAdalis@infosec.exchange 2025-05-30 01:58

@hakfoo@mstdn.party @neilsardesai@mastodon.social I was hoping to find a sample of the animation, best I can find is this: https://www.tenable.com/plugins/nnm/1305

Open ##2987165
@kodiacbear@tech.lgbt 2025-05-30 07:47

@hakfoo@mstdn.party I've been using Lotus Notes (actually now HCL Notes after some rebrandings) for work for nearly 25 years. Despite having used Notes 4.6 & 5.0, it's been so long that I can't remember their password field behaving that way. In more recent Notes versions, the password field produces a semi-random number of Xs for each password-character. @neilsardesai@mastodon.social

Open ##2987166
@saua@troet.cafe 2025-05-30 12:59

@hakfoo@mstdn.party @neilsardesai@mastodon.social I remember this as well, but never quite understood the details. Which, I guess, was part of the idea: it wasn't necessary to understand it, it was easily use intuitively. I also seem to remember that it didn't necessarily print one "*" for each typed letter, but "grouped" them in some way, so it wasn't even possible to "read" the length of the password purely from observing the password entry field.

Open ##2987168
@fennix@infosec.space 2025-05-30 13:02

@hakfoo@mstdn.party @neilsardesai@mastodon.social Yep, this was very useful for spotting typos in a field you can't see the contents of. It could be done securely but I would've bet there were problems with it.

Open ##2987169
@rl_dane@polymaths.social 2025-05-30 13:20

@hakfoo@mstdn.party @neilsardesai@mastodon.social As I recall, Lotus Notes just changed the password field output to a random number of asterisks after every key pressed, so the only way to guess a person's password length was to count each update, rather than counting the asterisks.

Open ##2987170
@loke@functional.cafe 2025-05-30 13:51

@hakfoo@mstdn.party @neilsardesai@mastodon.social Yes, it was Lotus Notes. That said, that does leak information, since it updated for each keystroke. So I'm not sure it's particularly secure.

Open ##2987171