4 ms·
"The what in where?" says typical user.
by djbusby 4y ago
"The what in where?" says typical user.
- booi 4y agoCan you just reset my password to P@ssword2023!
- ndsipa_pomu 4y agoNo, it can't be a previous password
- dexterdog 4y agoIt was P@ssword2022! previously
- qup 4y agoIt must contain a bizarre character that you would normally never use in a password.
- NoZebra120vClip 4y agoMy passwords always contain at least one poop emoji, the Sanskrit OM glyph, and the hieroglyph which means "motorcycle".
- qup 4y agoSure, but you should know that OpenAI disputes the translation of the moto hieroglyph, and they use it to mean "UFO" which is against policy and therefore not allowed in your password.
- bombolo 4y agoBut it can't be a space or a letter in your own non-english language, or our hashing algorithm breaks.
- qup 4y agoScratch that, you can't use spaces at all.
- bakugo 4y agoAny user that didn't pay attention when they were loudly and clearly told "SAVE THESE CODES OR YOU MAY LOSE YOUR ACCOUNT" probably doesn't actually care about their account that much.
- wintogreen74 4y agoUhm, really? Company punts on how to actually secure it by saying "store in a safe place" so now it's all on the user? Aren't we back to writing your long, complex PW on a post-it note then, with the extra step of "lock up your post it!"?
- bakugo 4y ago> Company punts on how to actually secure it by saying "store in a safe place" so now it's all on the user? Yes, it's on the user, who else would be responsible for that? A Google employee isn't gonna go to your house to install a safe for you so you can store it securely. You can argue all day that the average person often can't be trusted with these things but I fail to see how this is anyone's problem except their own, at some point we need to stop treating adults like babies that need their hands held through everything and let them learn that their decisions have consequences. 99% of people don't need that kind of security any way, just keep a piece of paper with the codes somewhere hidden that you can remember, you don't need to have access to them all the time unlike a normal password.
- shadowgovt 4y ago> at some point we need to stop treating adults like babies that need their hands held through everything and let them learn that their decisions have consequences. Never underestimate the massive market advantage gained from treating adults like babies and handling all manner of frustrations for them. UX researchers would call that "A good user experience."
- xp84 4y agoI much prefer this approach (and can take responsibility because I feel perfectly empowered to make as many copies and backups of my recovery keys as I need to make it effectively impossible for me to ever be locked out), but this whole thing points to how giving people the security they claim they want is at odds with their convenience at every touchpoint. I have repeatedly refused a family member's request to set a front door access code that is any family member's birthdate, a very common habit because that's the kind of thing people want to use. I continue to believe that security for nontechnical users is not a solved problem. WebAuthN or whatever may someday help solve this puzzle, but only if someone packages it in a way that is so frictionless that it's easier than just using your birthday and initials as your password for every account like my dad did. And if the recovery story for the "All my electronic devices fell into a lake" situation is something less exploitable than the pathetic SMS. I'm thinking notarized letter as someone else pointed out.