3 ms·
So companies shouldn't allow users to use poor passwords? Because it seemed harsh to me, maybe I don't care about them security of some data and so use a weak
by pbhjpbhj 3y ago
So companies shouldn't allow users to use poor passwords?
Because it seemed harsh to me, maybe I don't care about them security of some data and so use a weak password; that's on me, surely?
- johncessna 3y agoAs someone who reads hackernews and works on security systems, yes, absolutely. Run their passwords through haveibeenpwned and disallow anything that shows up. Based on the feedback I hear from my non-tech friends and family, not allowing them to use their single password used for everything would be a good way to exclude those folks from using whatever service you're trying to sell them.
- pbhjpbhj 3y agoI was being argumentative there, I think the email-based auth is probably right for a site like this. Force complex passwords and people will often just do a reset every time anyway.
- Retr0id 3y agoCompanies have legal (and moral) obligations to protect user data. Those obligations don't go away for users that don't personally care.
- pbhjpbhj 3y agoPerhaps not legally, but morally? I'll have a good chin-scratch on that one. Thanks for your comment.
- bparsons 3y ago2FA is the standard these days for accessing PID. I can't think of data more sensitive or personal than your DNA.