3 ms·
Not that it's an excuse, but I've personally seen many "technology averse" people struggle with the changing "rules" about passwords. When they started using c
by Klathmon 9y ago
Not that it's an excuse, but I've personally seen many "technology averse" people struggle with the changing "rules" about passwords.
When they started using computers, they were taught to NEVER write your password down and to do things like replace letters like I with numbers like 1 for security.
Not only are those not true any more, but the opposite is recommended. Making a unique LONG password is much more important, and writing it down on a sticky note next to your monitor is arguably more secure from some threats than even something like LastPass.
- TallGuyShort 9y agoWell a lack of rules (but a list of recommendations, perhaps) would be a solution there, not a maximum of 8 characters. Maximum password lengths just screams out to me that they're not hashing and just storing passwords directly in a database with a fixed-size column for passwords.
- Klathmon 9y agoOh I absolutely 100% agree, I just wanted to point out that sometimes a lot of these seemingly crazy reasons come from somewhere, and that as developers that might work with product managers like this, it's our job to help teach them. But maximum lengths (that aren't measured in kb) are a monumentally stupid thing, as are most other password "rules" (No, disallowing words in your password is not a good idea...) Provide a minimum length, and check passwords against common password lists, and use a damn good hashing algorithm with a process in place to easily allow upgrading that hash.