4 ms·

Can't possibly work. Everyone is going to have their own notebook for passwords, protected by rubber band. Yay. Also, I use a password manager on my machines (

Can't possibly work. Everyone is going to have their own notebook for passwords, protected by rubber band. Yay. Also, I use a password manager on my machines (for websites I use privately: amazon, taxes, etc.), a different one at work (for corporate tools). I also use my own passwords + 2FA(if available) for things I use at both places (like my own gmail, HackerNews, etc.). Forcing users to remember/write down something is just a bad idea. Chances are your "reset password" feature will be DDoS-ed into oblivion by your legitimate users. Much better alternatives: * the Google push notification: [0]; * a YubiKey or similar U2F token [1]; * a way to turn my smartphone into an automated keyboard that holds my secrets. [0] https://www.howtogeek.com/260369/how-to-set-up-google%E2%80%99s-new-code-less-two-factor-authentication/ https://www.howtogeek.com/260369/how-to-set-up-google%E2%80%... [1] https://www.yubico.com/start/ https://www.yubico.com/start/

zargon 8y ago
These arguments aren't convincing me. I still like devit's idea. > Can't possibly work. Everyone is going to have their own notebook for passwords, protected by rubber band. Yay. I don't consider this a bad thing per se. A notebook of secure passwords is a lot better than dictionary passwords. (Dictionary in the sense of a leaked password dictionary.) > Chances are your "reset password" feature will be DDoS-ed into oblivion by your legitimate users. I had a co-worker who, on most sites, set passwords by mashing the keyboard and then always logged in using the reset password functionality. I also don't see the problem with this.