3 ms·
I can understand if a government service requires this but it also happens with a normal, ecommerce website!
by sonnk 7y ago
I can understand if a government service requires this but it also happens with a normal, ecommerce website!
- moviuro 7y agoI really don't understand why. Please explain.
- kelnage 7y agoIf it's a US Federal Government service, you should point out to them that they are going against the explicit recommendation of NIST[1]. 1. https://pages.nist.gov/800-63-3/sp800-63b.html#sec5 https://pages.nist.gov/800-63-3/sp800-63b.html#sec5, under 5.1.1.2 Memorized Secret Verifiers, 'Verifiers SHOULD permit claimants to use “paste” functionality when entering a memorized secret.'
- 0xffff2 7y agoSadly the US Federal Government is a massive and unwieldy collection of organizations. I work in the Federal government and my part of it doesn't comply with NIST's modern guidelines at all. They probably will at some point, but department/agency level IT changes take years to be approved.
- mcv 7y agoI do not understand why a government service would require this. Governments should improve security, not undermine it. (Then again, most governments don't seem to care much about what I think they should be doing.)
- sonnk 7y agoThe generated password is usually just random string and hard to memorise. If you need to use the password outside of the web, e.g. on telephone or in a physical office, then it makes sense to use a password you creates. This is similar to the "master password" used by password manager, you should remember it by heart instead of generating a random one.
- dsfasfasfas 7y agoWell in my little corner of the US govt the web certificates are usually expired and I can't log into my work email from home.
- 0xffff2 7y agoAre they actually expired? In both corners of the US government that I've worked most of the certificates are self-signed and work computers have the agency's root certs added to the browser.