3 ms·

> if the user getting their password stolen is not a problem for you because it's not your responsibility to handle these issues (like a hacker news account for

by aleksei 10y ago

> if the user getting their password stolen is not a problem for you because it's not your responsibility to handle these issues (like a hacker news account for instance) then just let the user pick whatever they want and deal with the consequences. If they care enough about it they'll care enough to pick a decent password. Surely that's a cop-out? If the user getting their data stolen is not a big deal for you, why bother securing any system at all? The reason service providers set password rules is because there are many, many people who do not understand what a good password is, or the risks associated with losing them. There are people out there using the same password for everything, unaware that the compromise of one service can spell doom for their financial life. Developers really need to start taking responsibility for their code. Setting password rules, while arbitrary, are about protecting users. This may upset those who are tech-savvy and know what they are doing, but that really weighs nothing compared to the benefits it brings to those who are not.

tboyd47 10y ago
I guess Atwood's point is that it's impossible for developers to stop users from creating dumb passwords just using regexes. That much is true. Even if you require an uppercase letter, lowercase letter, special character, and number, you're still going to have a lot of passwords like "Password_1" coming in. And then, if you require people to change their password every so often, it will become "Password_2," "Password_3," etc. There's no easy way around this. It is weird that he goes on to suggest a complex system of rules literally right after saying rules are bad, and that's the point where he lost me too. If users don't understand what a good password is, they are going to eventually get an account compromised somewhere, if not on your site, then on another. In cases where there's no liability back to you, then there's no sense in babying them. If you do have liability, then two-factor authentication is probably a better way to go. I personally would hate it if a company forced me to use their generated passwords because I like to manage my own passwords.
- aleksei 10y ago
  Okay, I see the issue regarding regexes. However I take offense at the notion of "babying" users. We are all babied in some aspect of our lives: if it weren't for the active work and intervention of those in other fields, we wouldn't know whether the food we eat is safe, or if the roof isn't going to collapse during the night. I'd like developers to assume some responsibility for their users in turn. But I concede that may be beside the point in the case of password rules.

by aleksei 10y ago

tboyd47 10y ago

I guess Atwood's point is that it's impossible for developers to stop users from creating dumb passwords just using regexes. That much is true. Even if you require an uppercase letter, lowercase letter, special character, and number, you're still going to have a lot of passwords like "Password_1" coming in. And then, if you require people to change their password every so often, it will become "Password_2," "Password_3," etc. There's no easy way around this. It is weird that he goes on to suggest a complex system of rules literally right after saying rules are bad, and that's the point where he lost me too. If users don't understand what a good password is, they are going to eventually get an account compromised somewhere, if not on your site, then on another. In cases where there's no liability back to you, then there's no sense in babying them. If you do have liability, then two-factor authentication is probably a better way to go. I personally would hate it if a company forced me to use their generated passwords because I like to manage my own passwords.

aleksei 10y ago
Okay, I see the issue regarding regexes. However I take offense at the notion of "babying" users. We are all babied in some aspect of our lives: if it weren't for the active work and intervention of those in other fields, we wouldn't know whether the food we eat is safe, or if the roof isn't going to collapse during the night. I'd like developers to assume some responsibility for their users in turn. But I concede that may be beside the point in the case of password rules.