8 ms·
Then we need to encourage more users to use password managers. I propose registration screens should recommend at least bitwarden. Website password complexity
by antifa 4y ago
Then we need to encourage more users to use password managers.
I propose registration screens should recommend at least bitwarden.
Website password complexity rules should warn and enforce that MFA will be required for passwords less than 72 characters.
- WorldMaker 4y agoIf you're just going to enforce MFA on weak passwords anyway, what do you need the weak passwords for exactly? This is almost the exact line of reasoning why Microsoft, Apple, and Google have (finally) all agreed to work together to eliminate passwords altogether. Which probably is the only way that we can solve this: eliminate passwords, use proper keys and attestations instead of passwords, and try to make the user experience as nice as possible and at least no worse than yesterday's TOTP 2FA. (And yes, there are lots of valid complaints for power users that know how to use a password manager today that any such key management platforms would be a worse single point of failure than their existing password manager because it would be more opaque and harder to user-manage/export. It's an interesting trade off for average user security, at least.)