3 ms·
Some other ones: 1. Don't disable paste on the password box. Pasting usually means a long, complex password and that's a good thing. 2. Don't limit allowable
by curun1r 8y ago
Some other ones:
1. Don't disable paste on the password box. Pasting usually means a long, complex password and that's a good thing.
2. Don't limit allowable characters or have an artificially low max-length. It's okay to cap it for DoS purposes, but anything shorter than 64 characters (which maxes out to 256 bytes, given unicode) means you're doing something wrong on the backend.
3. SMS is not MFA. I'm terrified by the number of banks accounts that could be accessed by hijacking my SIM. It is inexcusable.