3 ms·
The most useful thing we can do as web developers: - support very long passwords, so that users can use pass-phrases if they like. - use bcrypt or the like fo
by jasonwatkinspdx 16y ago
The most useful thing we can do as web developers:
- support very long passwords, so that users can use pass-phrases if they like.
- use bcrypt or the like for storage
- do not create easily cracked side channels, like a fixed set of "security questions" for forgotten passwords
- teaspoon 16y agoYou should also make your sites amenable to password managers that autofill and submit login forms. Bank of America, for example, foils 1Password by spreading login across two forms and using a custom, non-machine-discoverable "submit" button in one of them.
- jerfelix 16y agoForget "security questions" altogether. We've gone to a set of "insecurity questions". It makes people smile when they've forgotten their password. "Do these jeans make me look fat? "Why is everyone staring at me?" "Is there something in my teeth?" "Are they talking about me?" ... yes I jest, but that would be cute (and serve no practical purpose).