3 ms·

The suggestion to make password reset opt-in during signup will never fly. Useful advise starts from the actual behavior of today's users, not the hypothetical

• CiPHPerCoder 10y ago
  That depends on your threat model and your audience. If you're building a typical e-commerce platform, no, it won't. That's why the recommendation is so watered down with "if reasonably practical" and has entire sentences dedicated to "it's OK if you default to Yes, but please give them a choice". But if you're building the next Silk Road? You should default to opting users out unless they check the opt-in box.
• tptacek 10y ago
  It is really difficult for me to think of an application used by consumers that could sustainably manage password reset as an option, even if the option defaulted to "on". Just having the option would generate an untenable amount of expensive support calls.
  • CiPHPerCoder 10y ago
    > Just having the option would generate an untenable amount of expensive support calls. I can see the potential for that to be true, but I don't think there's any evidence that this is necessarily true. Specifically: If you bury the option where only power users (i.e. the kind of users who are likely to use GnuPG and KeePassX) will trivially find it, the sort of folks who never change defaults would leave it enabled.