Study. uk . com
  1. Home
  2. All questions
  3. Question 322

CISSP study material · question 322 of 500

A design team debates whether offering to reveal the password as it is typed weakens security. What does NIST SP 800-63B recommend?

  1. A verifier must always mask the password with dots or asterisks.
  2. A verifier may reveal the password only after successful authentication.
  3. A verifier may reveal the password only on devices with a hardware keyboard.
  4. A verifier should offer the option to display the password while it is entered, so the claimant can confirm the entry.
Show the answer

Answer: D. A verifier should offer the option to display the password while it is entered, so the claimant can confirm the entry.

Showing the typed characters instead of masking them lets a claimant in a private setting check the entry before it is submitted.

Source: NIST SP 800-63B Rev. 4 (NIST) — SP 800-63B-4 > 3.1.1.2 Password Verifiers

Challenge yourself on this topic → Study as cards