Absolutely. I wasn't really clear. I didn't mean it needs an explanation of hashing. I meant there needs to be some short answer to the question of "if they can't pull out my password, how do the check it?"
I don't think people are thinking about keys and locks. Passwords are a thing that existed before computers and that people understand perfectly outside of an IT context. Spies in films use secret phrases to prove they're the contact, kids use passwords to gain access to the clubhouse. But in all these non IT contexts the person checking the authentication knows the shared secret, so it's obvious how they check it.
If my mental model is "I've arranged a secret password with this website that proves I'm really me", then my first question when told the website doesn't know what secret password is "well how does it know that the password is correct?".
The best I've been able to come up with today is a somewhat lengthy metaphone with color mixing.
[Edit]
Having said that, I just went and talked to my technical literate non programmer wife and she used the key and door analogy.
I don't think people are thinking about keys and locks. Passwords are a thing that existed before computers and that people understand perfectly outside of an IT context. Spies in films use secret phrases to prove they're the contact, kids use passwords to gain access to the clubhouse. But in all these non IT contexts the person checking the authentication knows the shared secret, so it's obvious how they check it.
If my mental model is "I've arranged a secret password with this website that proves I'm really me", then my first question when told the website doesn't know what secret password is "well how does it know that the password is correct?".
The best I've been able to come up with today is a somewhat lengthy metaphone with color mixing.
[Edit] Having said that, I just went and talked to my technical literate non programmer wife and she used the key and door analogy.