Eric F. Savage

Good stuff, updated weekly(ish)

Locked Doors, Open Windows

Most people with any clue about interaction design know that Jakob Nielsen is a jackass. There are thousands of other usability professionals who offer opinions as fact, don’t take their own advice, but Nielsen was there in the early days, and for some reason caught on with his obvious or wrong ideas.

His latest “alertbox” (apologies for linking to such a horrible looking site) says that users are so completely dumb and clumsy that they can’t type passwords in correct, and that masking is a bad idea. Wow. I’ve never mentioned or linked to Jakob Nielsen on this blog before, but I feel a duty to contribute what meager link juice I have to making this astonishing bit of advice the highest ranked page on that site. What would cause someone to suggest that this first layer of security is a detriment?

More importantly, there’s usually nobody looking over your shoulder when you log in to a website. It’s just you, sitting all alone in your office, suffering reduced usability to protect against a non-issue.

Really? My apologies Mr. Nielsen. All these years I thought your ideas were bad because you just made stuff up and wanted to sound like you knew what you were talking about. Little did I know that your lack of clue regarding how people use computers is the result of the fact that you don’t work with actual people. You should do one of your infamous studies (preferably of indeterminate size and method, as usual) and see if people log in to websites from exotic venues like the “train station” or maybe even a “meeting”.

  • http://kradeleet.com keith

    office? what is this “office” you speak of?

    clearly he only is concerned about managers, who cares if the cubicle proles have their passwords cribbed. After all they can be replaced like so many broken light bulbs…

    on the other hand, i’ve repeatedly seen people do things like a) accidentally type their password in the wrong window (okay, *I’ve* done that — with people in my cube) or b) forget to remove their hardcoded password from a script they sent out to the team.

    Clearly though I don’t do the sort of important password-protected work that jakob nielsen does.

    I suppose Richard Stallman doesn’t have the mistyped password problem, either — as he doesn’t use them.

Entries (RSS) and Comments (RSS).