3 ms·

Letting users choose passwords is the default behavior of websites, but it's incredibly dumb. Just generate a random password on the server side and tell the u

by devit 8y ago

Letting users choose passwords is the default behavior of websites, but it's incredibly dumb. Just generate a random password on the server side and tell the user to store it in their password manager or in a plain text file. Do not let users enter their own password under any circumstance. All password issues solved instantly (yeah, if the client is compromised the password is too, but the attacker can install a keylogger and accomplish the same task anyway). Plus it's much more user friendly, since the user just needs to follow instructions and is not required to somehow "invent" a password.

moviuro 8y ago
Can't possibly work. Everyone is going to have their own notebook for passwords, protected by rubber band. Yay. Also, I use a password manager on my machines (for websites I use privately: amazon, taxes, etc.), a different one at work (for corporate tools). I also use my own passwords + 2FA(if available) for things I use at both places (like my own gmail, HackerNews, etc.). Forcing users to remember/write down something is just a bad idea. Chances are your "reset password" feature will be DDoS-ed into oblivion by your legitimate users. Much better alternatives: * the Google push notification: [0]; * a YubiKey or similar U2F token [1]; * a way to turn my smartphone into an automated keyboard that holds my secrets. [0] https://www.howtogeek.com/260369/how-to-set-up-google%E2%80%99s-new-code-less-two-factor-authentication/ https://www.howtogeek.com/260369/how-to-set-up-google%E2%80%... [1] https://www.yubico.com/start/ https://www.yubico.com/start/
- zargon 8y ago
  These arguments aren't convincing me. I still like devit's idea. > Can't possibly work. Everyone is going to have their own notebook for passwords, protected by rubber band. Yay. I don't consider this a bad thing per se. A notebook of secure passwords is a lot better than dictionary passwords. (Dictionary in the sense of a leaked password dictionary.) > Chances are your "reset password" feature will be DDoS-ed into oblivion by your legitimate users. I had a co-worker who, on most sites, set passwords by mashing the keyboard and then always logged in using the reset password functionality. I also don't see the problem with this.

by devit 8y ago

moviuro 8y ago

Can't possibly work. Everyone is going to have their own notebook for passwords, protected by rubber band. Yay. Also, I use a password manager on my machines (for websites I use privately: amazon, taxes, etc.), a different one at work (for corporate tools). I also use my own passwords + 2FA(if available) for things I use at both places (like my own gmail, HackerNews, etc.). Forcing users to remember/write down something is just a bad idea. Chances are your "reset password" feature will be DDoS-ed into oblivion by your legitimate users. Much better alternatives: * the Google push notification: [0]; * a YubiKey or similar U2F token [1]; * a way to turn my smartphone into an automated keyboard that holds my secrets. [0] https://www.howtogeek.com/260369/how-to-set-up-google%E2%80%99s-new-code-less-two-factor-authentication/ https://www.howtogeek.com/260369/how-to-set-up-google%E2%80%... [1] https://www.yubico.com/start/ https://www.yubico.com/start/

zargon 8y ago
These arguments aren't convincing me. I still like devit's idea. > Can't possibly work. Everyone is going to have their own notebook for passwords, protected by rubber band. Yay. I don't consider this a bad thing per se. A notebook of secure passwords is a lot better than dictionary passwords. (Dictionary in the sense of a leaked password dictionary.) > Chances are your "reset password" feature will be DDoS-ed into oblivion by your legitimate users. I had a co-worker who, on most sites, set passwords by mashing the keyboard and then always logged in using the reset password functionality. I also don't see the problem with this.