3 ms·
So do password managers. Websites concerned about password use should provide an option to use a randomly-generated password (generated by the website, not the
by Wowfunhappy 3y ago
So do password managers.
Websites concerned about password use should provide an option to use a randomly-generated password (generated by the website, not the user) in leu of MFA. This guarantees the password is unique and complex, and practically ensures that the user has a password manager.
- lucasyvas 3y agoI agree in spirit but not in practice. I don't think a website should be trusted to generate a random password - leave that to browser infrastructure (which includes extensions).
- Wowfunhappy 3y agoThe idea is that by generating a unique password for the user, the website guarantees that it really is a unique password. How else can you do that? How is this different from the way we handle e.g. api keys?
- arccy 3y agostill vulnerable to password db leaks
- shortrounddev2 3y agoOnly if you don't hash and salt