Plaintext display in password and code fields widens shoulder-surfing exposure
Aliases: over-the-shoulder attack · masked input · plaintext echo
What it is
Shoulder surfing is a bystander obtaining what someone types by watching the screen — or a camera doing the same. Masked display (dots or asterisks) is the classic defense; plaintext echo, where characters appear as typed, is a usability concession inside it: the longer and more completely characters show, the larger the disclosure window. This entry is about how echo policy maps onto that risk.
Why it happens
Risk is set by how much a bystander can extract: masked display leaks only length (itself a cue), plaintext echo leaks everything. The usability case for echo is error correction — touchscreens have no tactile feedback, so typos must be seen. Countermeasures therefore move toward partial echo: showing only the most recent character, converting to masks after a few hundred milliseconds, or randomizing on-screen keyboard layout to defeat gaze-trail tracking. Cameras make the attack asynchronous — shoulder surfing no longer requires a person behind you, since public footage can be analysed offline — which raises the defensive bar from "obscure it" to "minimize per-frame extractable information." Two-factor contexts compound the risk: the password field is masked while the SMS code sits in full text on a notification banner — the second factor of the same login is exposed bare.
Studying it
Paradigms: observation studies recording how often people enter sensitive information in public and what shielding behaviour they show (hand over the phone, turn away); controlled experiments manipulating echo policy (full mask / last-character echo / timed echo) and measuring entry speed, correction counts, and bystander reconstruction rates; on-screen keyboard studies comparing fixed versus randomized layouts for trail leakage. Dependent variables: entry duration, error rate, proportion of bystanders reconstructing the secret correctly. Methodological cautions: lab shoulder surfing differs from real conditions (walking, distance, video), so reconstruction rates do not transfer directly; older users have higher correction needs, and tightened echo policy taxes them disproportionately.
Where it stops holding
Masks defeat direct close-range viewing but not cameras; randomized keyboards defeat trail recording but not direct gaze — each defense covers one subset of attack vectors. Tightening echo has a usability floor: zero echo pushes touchscreen entry error past acceptability, especially for long passphrases and bilingual input. "Cover your screen" education barely works — a defense that depends on users remembering to shield is as unreliable as one that depends on users remembering to verify.
Applying it
- Default to masked display; offer an explicit "show" toggle instead of automatic plaintext, and auto-revert masked after a short expiry.
- Use last-character or single-character flash echo for verification codes; never simultaneously display the SMS code in full on a lock-screen notification (align with the lock-screen preview policy).
- Evaluate randomized numeric keypads for high-stakes flows (payments, finance); consider physical privacy filters for shared terminals.
- Verification: usability tests must clear both bars — entry efficiency (duration, correction rate) and bystander reconstruction (have observers watch the recorded screen and recall the secret).