3 ms·

If the password is randomly generated by the service then you need a way to present the password to the user in plain text. I think you're trading 1 problem for

by nickjj 9y ago

If the password is randomly generated by the service then you need a way to present the password to the user in plain text. I think you're trading 1 problem for another.

always_good 9y ago
If your users are getting pwned because they reuse their easy leaked passwords on your service, then that's the real world adversary. Also, all passwords appear in plaintext at some point. Even when sitting in a type="password" field that was autofilled by your uber secure password manager. The main problem is that this solution is just pointlessly bad UX for most sites. But worth it (or something like it) if your users are losing real money.
ryan-c 9y ago
That's fine. Storing passwords in plaintext is the problem. It could be displayed as selectable/copyable but not visible text by default with a "reveal" button to prevent shoulder surfing.
- nickjj 9y ago
  Yes, that "show once" feature works well for keys / tokens because developers usually use them right away in their app so it doesn't get lost. But for a regular person, you may put them into a deadlock if you generate a secure random 16 character password with 1 chance to remember it. Just imagine dropping "K@!G-:)XTqqy<44x" in front of a regular user telling them they have 1 shot to store this password before it disappears forever. Most people who aren't into tech are just going to give up and leave IMO. It took me like 5 minutes to explain case sensitivity to my dad who knows computers well enough to do day trading but calls me up for things like "why can't I login to my email?". Asking him to type in a password like that would probably give him a stroke. Emailing it to them in plain text is also not a reasonable solution. Not only is it wildly insecure, but you would be surprised at how many people don't know how to copy / paste text.
  - ryan-c 9y ago
    You would still offer a "password reset" feature. Tell them to write it down or keep it in a password manager, and provide links. Maybe call it an access code rather than a password to avoid "don't write down your password" training.

by nickjj 9y ago

If the password is randomly generated by the service then you need a way to present the password to the user in plain text. I think you're trading 1 problem for another.

always_good 9y ago

If your users are getting pwned because they reuse their easy leaked passwords on your service, then that's the real world adversary. Also, all passwords appear in plaintext at some point. Even when sitting in a type="password" field that was autofilled by your uber secure password manager. The main problem is that this solution is just pointlessly bad UX for most sites. But worth it (or something like it) if your users are losing real money.

ryan-c 9y ago

That's fine. Storing passwords in plaintext is the problem. It could be displayed as selectable/copyable but not visible text by default with a "reveal" button to prevent shoulder surfing.

nickjj 9y ago
Yes, that "show once" feature works well for keys / tokens because developers usually use them right away in their app so it doesn't get lost. But for a regular person, you may put them into a deadlock if you generate a secure random 16 character password with 1 chance to remember it. Just imagine dropping "K@!G-:)XTqqy<44x" in front of a regular user telling them they have 1 shot to store this password before it disappears forever. Most people who aren't into tech are just going to give up and leave IMO. It took me like 5 minutes to explain case sensitivity to my dad who knows computers well enough to do day trading but calls me up for things like "why can't I login to my email?". Asking him to type in a password like that would probably give him a stroke. Emailing it to them in plain text is also not a reasonable solution. Not only is it wildly insecure, but you would be surprised at how many people don't know how to copy / paste text.
- ryan-c 9y ago
  You would still offer a "password reset" feature. Tell them to write it down or keep it in a password manager, and provide links. Maybe call it an access code rather than a password to avoid "don't write down your password" training.