4 ms·

I would like to see a version of 1Password that 1) did only passwords - no fishing licenses and secure notes, which adds UX complexity 2) did not distinguish be

I would like to see a version of 1Password that 1) did only passwords - no fishing licenses and secure notes, which adds UX complexity 2) did not distinguish between passwords and logins, which causes endless confusion for my users 3) knew and managed the text requirements for the top 1000 websites so the app could generate legitimate passwords and not ask users to manage password complexity

azinman2 9y ago
Ohh I like the idea of knowing the password requirements for the top 1000 websites!
- chiefalchemist 9y ago
  Would it be wrong to wish this could (or should?) be standardized? That is, for example, one upper case letter, same special characters, etc. The lack of a standard seems to hurts users more than hackers. The hackers know it and adjust. User just get confused and default to overly simplistic and common PWs.
  - cmer 9y ago
    There should be a "robot.txt" for passwords. ie: /password.txt This file could define the accepted password format. Password managers could retrieve that file and know exactly how to generate a password.
    - cmrx64 9y ago
      no. if you're going to go through the trouble to do that, just fix your bullshit broken fucking password requirements.
      - chiefalchemist 9y ago
        The password - as currently implemented - is a fax machine (read: dated technology). Anyone reasonable sees it's far from ideal. Yet there seems to be little _significant_ innovation on solving this problem with something better. I can order a pizza via Twitter, but I'm still using passwords?
  - hmahncke 9y ago
    NIST recently updated their standard guidance to no specific characteristics requirements, just long and unique. But no doubt it will take a while to trickle down to many websites that they don’t need this craziness any more.
  - dwg 9y ago
    Many such efforts exist, but getting universal consensus let alone adoption isn't easy.
- acjohnson55 9y ago
  What if there were a protocol for password management, such that you never had to use a signup form again? Kind of like OAuth, but for a password generator/manager. It would support password changing (with an e-mail confirmation), so that it would be extremely easy for people to convert from manually managed passwords to automatically managed.
  - adrusi 9y ago
    Stupid awful password requirements are terrible (an upper case character, lowercase, number, symbol, also no spaces or colons or commas or semicolons or quotes) but the variance does serve to force people to not use the same password for every site.
    - acjohnson55 9y ago
      Such a protocol would be a great place to encode the user-facing aspects of NIST's recommendations.
dwg 9y ago
This would be quite hard to maintain. Instead they could create a "password complexity requirement specification" to allow sites to embed a universally machine readable description of their requirements, which all password managers and users could benefit from. I don't know if any such effort exists already.

azinman2 9y ago

Ohh I like the idea of knowing the password requirements for the top 1000 websites!

chiefalchemist 9y ago
Would it be wrong to wish this could (or should?) be standardized? That is, for example, one upper case letter, same special characters, etc. The lack of a standard seems to hurts users more than hackers. The hackers know it and adjust. User just get confused and default to overly simplistic and common PWs.
- cmer 9y ago
  There should be a "robot.txt" for passwords. ie: /password.txt This file could define the accepted password format. Password managers could retrieve that file and know exactly how to generate a password.
  - cmrx64 9y ago
    no. if you're going to go through the trouble to do that, just fix your bullshit broken fucking password requirements.
    - chiefalchemist 9y ago
      The password - as currently implemented - is a fax machine (read: dated technology). Anyone reasonable sees it's far from ideal. Yet there seems to be little _significant_ innovation on solving this problem with something better. I can order a pizza via Twitter, but I'm still using passwords?
- hmahncke 9y ago
  NIST recently updated their standard guidance to no specific characteristics requirements, just long and unique. But no doubt it will take a while to trickle down to many websites that they don’t need this craziness any more.
- dwg 9y ago
  Many such efforts exist, but getting universal consensus let alone adoption isn't easy.
acjohnson55 9y ago
What if there were a protocol for password management, such that you never had to use a signup form again? Kind of like OAuth, but for a password generator/manager. It would support password changing (with an e-mail confirmation), so that it would be extremely easy for people to convert from manually managed passwords to automatically managed.
- adrusi 9y ago
  Stupid awful password requirements are terrible (an upper case character, lowercase, number, symbol, also no spaces or colons or commas or semicolons or quotes) but the variance does serve to force people to not use the same password for every site.
  - acjohnson55 9y ago
    Such a protocol would be a great place to encode the user-facing aspects of NIST's recommendations.

dwg 9y ago

This would be quite hard to maintain. Instead they could create a "password complexity requirement specification" to allow sites to embed a universally machine readable description of their requirements, which all password managers and users could benefit from. I don't know if any such effort exists already.