4 ms·
If you are security conscious at all, you'd be generating a public/private key pair for website authentication, only using HTTPS and potentially preferring TOR.
by ioquatix 10y ago
If you are security conscious at all, you'd be generating a public/private key pair for website authentication, only using HTTPS and potentially preferring TOR. I mean, a username+password field is SO FAR from good security practices, it's almost a joke.
- morgante 10y agoI assume you're being farcical, but I would love if more sites offered authentication schemes beyond usernames and passwords. These days, I will refuse to log in to any website which doesn't support https.
- XorNot 10y agoI'd like APIs to automate rolling my passwords. Ideally keepass expires it, gives me a list and let's me day "go" and be automatically updates them all.
- LoSboccacc 10y agoOnce we had a chance to push openid to internet.... Now that would have been convenient. At least more are working toward google, twitter and facebook oauth, so a majority of services I use has no password at all.
- juliendorra 10y agoInterestingly, the french taxation department used to require you to identify on their website using a certificate, starting in the early 2000s. A few years ago they dropped this requirement and you can now login using just an email and password. The certificate-based identification process was really bad UI-wise so going with passwords probably helped them get more people to interact online instead of via paper forms.