4 ms·
You can try as hard as you want, but users will always find a way to bypass your precautions and shoot themselves in the foot. There's also a danger that if yo
by tiborsaas 6y ago
You can try as hard as you want, but users will always find a way to bypass your precautions and shoot themselves in the foot.
There's also a danger that if you try to do this, then your product turns into a UX nightmare.
- orev 6y agoDefaults matter. There’s a huge difference between starting an account with a complex password and then the user intentionally weakens it, vs starting with a weak password with a note saying “pretty please change it”. It’s obvious that some set of users will not change it, so it’s better to start in a default secure state than an insecure one. And yes, sometimes security and UX conflict, and users just need to deal with it.
- gabereiser 6y agoYes but in this case there was no auth and the user setup admin/admin. This was a human.
- tracker1 6y agoI tend to make a default passphrase of "Please change me." and require a password change on first login.