Screen scraping malware 'would benefit' from removing password masking

2009-07-01

Malware designed to steal passwords through the use of screen scraping would only benefit by having the classified information in the clear, it has been said.

Raz Yalov, chief technology officer for 41st Parameter, made this assertion to The Tech Herald after the website reported that usability expert Jakob Nielsen claimed passwords should be presented in clear text to make things easier for users.

"For mobile devices a different approach is appropriate, especially when the risk of shoulder surfing is reduced due to the size of the smaller screens and the fact you are using a personal device," Mr Yalov commented.

He admitted that providing a second factor form of authentication like a device ID, used in conjunction with a check box, can help to alleviate the effect of taking away masking from passwords.

Scraping programs could be stopped from attacking sites by obfuscating the http source code of a website, making it harder for machines to read it, according to experts at Sentor.