3 ms·
That's fine. Storing passwords in plaintext is the problem. It could be displayed as selectable/copyable but not visible text by default with a "reveal" button
by ryan-c 9y ago
That's fine. Storing passwords in plaintext is the problem.
It could be displayed as selectable/copyable but not visible text by default with a "reveal" button to prevent shoulder surfing.
- nickjj 9y agoYes, that "show once" feature works well for keys / tokens because developers usually use them right away in their app so it doesn't get lost. But for a regular person, you may put them into a deadlock if you generate a secure random 16 character password with 1 chance to remember it. Just imagine dropping "K@!G-:)XTqqy<44x" in front of a regular user telling them they have 1 shot to store this password before it disappears forever. Most people who aren't into tech are just going to give up and leave IMO. It took me like 5 minutes to explain case sensitivity to my dad who knows computers well enough to do day trading but calls me up for things like "why can't I login to my email?". Asking him to type in a password like that would probably give him a stroke. Emailing it to them in plain text is also not a reasonable solution. Not only is it wildly insecure, but you would be surprised at how many people don't know how to copy / paste text.
- ryan-c 9y agoYou would still offer a "password reset" feature. Tell them to write it down or keep it in a password manager, and provide links. Maybe call it an access code rather than a password to avoid "don't write down your password" training.