5 ms·

Ah, passwords. Look, webmasters, the simple truth is - I don't care. I have a default password that is very simple to memorise (and hence guess/hack), that I u

by tomp 9y ago

Ah, passwords. Look, webmasters, the simple truth is - I don't care. I have a default password that is very simple to memorise (and hence guess/hack), that I use for most logins, because frankly, I just don't care. Unless you're vitally important to my life (email, Facebook, backup, services that I use so often that they keep my personal/credit card data), your login/password is just an annoyance for me, as is your password security policy. I commend reddit and webshops that allow "checkout as guest", that recognise this.

Analemma_ 9y ago
You really should be using a password manager then. You still only have to memorize one password, but you’re not severely compromising your security anymore.
- TeMPOraL 9y ago
  Parent's point is that they don't care. It's not their security being compromised, but the site's. There are plenty of sites out there with unnecessary registration requirements. I don't mind setting a weak, throwaway password on those.
  - BlackFly 9y ago
    Don't forget to use a throwaway email account! Lot's of good email providers give temporary aliases for this reason.
    - msla 9y ago
      I like Spam Gourmet: https://www.spamgourmet.com/index.pl https://www.spamgourmet.com/index.pl
  - naasking 9y ago
    > Parent's point is that they don't care. It's not their security being compromised, but the site's. He'll care plenty if his hacked account posts a threat against the president and he gets a visit from the secret service.
- deleted 9y ago
  [deleted]
- JTbane 9y ago
  Now you have a single point of failure- namely your master password. Remember the LastPass debacle?
  - Deimorz 9y ago
    I don't. I remember when the press made a big deal about some LastPass things that they didn't understand and actually didn't matter. Was there an actual debacle at some point?
j_s 9y ago
HN?
danneu 9y ago
At the same time, requiring better passwords is an anti-spam mechanism for the platform. I once registered a Reddit account that had the same password as its username. After my first post, the account's password was changed and it started posting spam. The only explanation I have is that someone was crawling the latest posts and trying to crack new accounts so that they have a legit first post and registration IP address to avoid auto-moderation. Or, for example, a forum that drops all rate-limits once you are 1 year old with 1,000 posts. It now may be attractive to crack trusted accounts so that you can send mass PM spam. Or imagine if a moderator gets their password cracked. So it's not necessarily just in the best interest of the platform, but also everyone that uses the platform. Though that's no excuse for particularly annoying password requirements.
- bo1024 9y ago
  True, but this bar for password complexity is very low, unless the platform is allowing very high numbers of failed login attempts. The attacker can only try a tiny number of possible passwords (hopefully only thousands per day or less), which even very weak passwords can defeat.
Lagged2Death 9y ago
I have a default password that is very simple ... that I use for most logins ... Unless you're vitally important to my life... That's all fine if you're a perfect robot. It will turn out that you aren't, though. You could let one of your important passwords slip to a compromised dumb-password site by mistake; you could fail to appreciate how important a dumb-password site had become to you until it was too late; you could just make a human goof and set up PayPal (or what have you) with your dumb password. But your personal ability or inability to get this stuff perfectly correct forever is kind of beside the point when you're setting policy. In a population of dozens, mistakes will be made. In a population of millions, mistakes will be legion. If more organizations followed this guidance, it would make password systems easier to implement, easier to use, and more secure for everyone who did care. It wouldn't effect your practice in the slightest.
- gknoy 9y ago
  This same principle also applies if you have one Serious Business e-mail (job applications, professional-related things), and another "Just For Random Crap" email address -- you may find yourself, one day, having signed up for a cloud service or other thing (I don't know, bitcoin exchange?) with an account that you suddenly wish were your Serious Business one.
tim333 9y ago
Me too. I loved it that on the old youtube they didn't have any password restrictions and mine was 'x' for some years till Google took them over.
helipad 9y ago
I understand you might not care now, but what about later? A upset love interest, a border control agent, someone who disagrees with you on Twitter, the police, a frustrated colleague, children with too much time on their hands, trolls, hackers. None of these adversaries may be something to worry about today, but they might tomorrow. We can all aspire to be bland enough to not be targeted, but I'd like to have that insurance policy in place just in case.
andrewfong 9y ago
Another point worth considering: even if your site or app does require user accounts (and this is not a given), that's not the same as requiring a password login. For each user, just store a unique token and secret in local storage. That's their identity and password. So long as they log back in using the same machine (and they don't log out or are in incognito mode or whatever), they're good. For most sites or apps, this will be good enough for 90% of your users 90% of the time. Now if you want to enable logging back in on another device, just ask for an email during your sign up. Then, when your user logs in from another device, you can email a login link that resets a new token / secret. Maybe a little more inconvenient for the user than just asking for a password, but it's a fairly minor inconvenience and it saves you from having to deal with storing passwords and worrying about screwing that up. Plus it removes a step from your first-time sign up process! Which probably matters more than ease of re-logging in from another device.
- Sleeep 9y ago
  Why is this downvoted? This is what a few sites do (ie, Craiglist) and it works well and I prefer it. It's not much different than a password with email recovery option. I've also seen shopping sites do this to manage past orders.
adrianratnapala 9y ago
There is little lost by a high complexity requirement. Just generate some random gibberish and let your browser remember it.

by tomp 9y ago

Analemma_ 9y ago

You really should be using a password manager then. You still only have to memorize one password, but you’re not severely compromising your security anymore.

TeMPOraL 9y ago
Parent's point is that they don't care. It's not their security being compromised, but the site's. There are plenty of sites out there with unnecessary registration requirements. I don't mind setting a weak, throwaway password on those.
- BlackFly 9y ago
  Don't forget to use a throwaway email account! Lot's of good email providers give temporary aliases for this reason.
  - msla 9y ago
    I like Spam Gourmet: https://www.spamgourmet.com/index.pl https://www.spamgourmet.com/index.pl
- naasking 9y ago
  > Parent's point is that they don't care. It's not their security being compromised, but the site's. He'll care plenty if his hacked account posts a threat against the president and he gets a visit from the secret service.
deleted 9y ago
[deleted]
JTbane 9y ago
Now you have a single point of failure- namely your master password. Remember the LastPass debacle?
- Deimorz 9y ago
  I don't. I remember when the press made a big deal about some LastPass things that they didn't understand and actually didn't matter. Was there an actual debacle at some point?

j_s 9y ago

HN?

danneu 9y ago

At the same time, requiring better passwords is an anti-spam mechanism for the platform. I once registered a Reddit account that had the same password as its username. After my first post, the account's password was changed and it started posting spam. The only explanation I have is that someone was crawling the latest posts and trying to crack new accounts so that they have a legit first post and registration IP address to avoid auto-moderation. Or, for example, a forum that drops all rate-limits once you are 1 year old with 1,000 posts. It now may be attractive to crack trusted accounts so that you can send mass PM spam. Or imagine if a moderator gets their password cracked. So it's not necessarily just in the best interest of the platform, but also everyone that uses the platform. Though that's no excuse for particularly annoying password requirements.

bo1024 9y ago
True, but this bar for password complexity is very low, unless the platform is allowing very high numbers of failed login attempts. The attacker can only try a tiny number of possible passwords (hopefully only thousands per day or less), which even very weak passwords can defeat.

Lagged2Death 9y ago

I have a default password that is very simple ... that I use for most logins ... Unless you're vitally important to my life... That's all fine if you're a perfect robot. It will turn out that you aren't, though. You could let one of your important passwords slip to a compromised dumb-password site by mistake; you could fail to appreciate how important a dumb-password site had become to you until it was too late; you could just make a human goof and set up PayPal (or what have you) with your dumb password. But your personal ability or inability to get this stuff perfectly correct forever is kind of beside the point when you're setting policy. In a population of dozens, mistakes will be made. In a population of millions, mistakes will be legion. If more organizations followed this guidance, it would make password systems easier to implement, easier to use, and more secure for everyone who did care. It wouldn't effect your practice in the slightest.

gknoy 9y ago
This same principle also applies if you have one Serious Business e-mail (job applications, professional-related things), and another "Just For Random Crap" email address -- you may find yourself, one day, having signed up for a cloud service or other thing (I don't know, bitcoin exchange?) with an account that you suddenly wish were your Serious Business one.

tim333 9y ago

Me too. I loved it that on the old youtube they didn't have any password restrictions and mine was 'x' for some years till Google took them over.

helipad 9y ago

I understand you might not care now, but what about later? A upset love interest, a border control agent, someone who disagrees with you on Twitter, the police, a frustrated colleague, children with too much time on their hands, trolls, hackers. None of these adversaries may be something to worry about today, but they might tomorrow. We can all aspire to be bland enough to not be targeted, but I'd like to have that insurance policy in place just in case.

andrewfong 9y ago

Another point worth considering: even if your site or app does require user accounts (and this is not a given), that's not the same as requiring a password login. For each user, just store a unique token and secret in local storage. That's their identity and password. So long as they log back in using the same machine (and they don't log out or are in incognito mode or whatever), they're good. For most sites or apps, this will be good enough for 90% of your users 90% of the time. Now if you want to enable logging back in on another device, just ask for an email during your sign up. Then, when your user logs in from another device, you can email a login link that resets a new token / secret. Maybe a little more inconvenient for the user than just asking for a password, but it's a fairly minor inconvenience and it saves you from having to deal with storing passwords and worrying about screwing that up. Plus it removes a step from your first-time sign up process! Which probably matters more than ease of re-logging in from another device.

Sleeep 9y ago
Why is this downvoted? This is what a few sites do (ie, Craiglist) and it works well and I prefer it. It's not much different than a password with email recovery option. I've also seen shopping sites do this to manage past orders.

adrianratnapala 9y ago

There is little lost by a high complexity requirement. Just generate some random gibberish and let your browser remember it.