6 ms·
"since they don’t yet offer OAuth" OAuth wouldn't solve the problem though, it'd just move it somewhere else. Use a different login for each site - use a pass
by axod 18y ago
"since they don’t yet offer OAuth"
OAuth wouldn't solve the problem though, it'd just move it somewhere else.
Use a different login for each site - use a password manager.
- dbrown26 18y agoThat's a good point. OAuth would at least centralize the problem towards a more trusted source and limit the number of places the credentials would be stored. I trust Google or Facebook to have more safeguards in place than a webapp that popped up yesterday. As for password managers, I totally agree people should use them, but as a practical matter, most non-tech people do not.
- axod 18y agoYou trust Google to control all your logins ;) I have a cautionary tale to tell about that one...
- dbrown26 18y agoI cetainly don't trust them to control all my logins. But my level of trust for them is much higher than for most in terms of their ability to secure their databases and applications. I use different levels of passwords, depending on the type of site: nytimes.com < gmail.com < bankofamerica.com. I have tried to use password manager, and am currently trying one out on Safari, but the use of many computers makes it difficult.
- thwarted 18y agoI hope that gmail.com account isn't used for email password recovery for the bankofamerica.com account.
- tptacek 18y agoFor a huge percentage of all Internet users, a Google or Yahoo compromise is game-over; they're going to lose their bank account, and then their social, and their identity (if they lose the lottery). So centralizing on Google or Yahoo is a sensible plan. As for your cautionary tale, I'm pretty familiar with the players here, axod. Why don't you tell us?
- axod 18y agoGoogle shut off my account for a week and I lost access to everything google controls - adsense, adwords, gmail, google code, youtube, blogger, google apps, google for domains etc etc They shut it off because "Someone tried to log in to it unsuccessfully" Probably for the average person though as you say, centralizing control is probably easiest until something like that happens to them. Wouldn't an idea be to centralize this with your ISP? The ISP already knows who you are, seems like they would be a good authority on handling authentication to websites for you. (OK, doesn't work for when you're using some hotel wifi etc)
- tptacek 18y agoFew months ago, someone I know (nontechnical) lost their password on a public blog server. Unfortunately, like most people, they used the same password on their Yahoo mail account. Inside of a day, they: * Got locked out of their Yahoo mail account for a week * Lost their GoDaddy account, got locked out of it, and had it redirected to a gay porn site * Lost their bank account, had thousands in fraudulent charges racked up, and got locked out of the account * Had all their Yahoo mailing lists scrubbed, and each mailing list member (including his kids soccer team, which he ran) spammed with gay porn stuff * Had his tax dox and personal mail dumped in public. It sounds like your Google experience sucked. But I can think of worse things that can happen than a beaurocratic SNAFU. Let's not just hope that people will get smart about their passwords.
- ivey 18y agoAgreed on the password manager. I've got 1Password in Safari, and the "Generate Password" option is so easily available it becomes second nature.
- andreyf 18y agoSounds like that would make it much harder to switch browsers...
- ivey 18y agoSpeaking only of 1Password, they have plugins for most, that share the same database. Also syncs to my iPhone.
- reconbot 18y agoThat's why I use SuperGenPass, it works on every browser, it's open source (it's Javascript) it's handy and it even works on my phone. I've got a different password for almost every site now and I don't even have to know them.
- tav 18y agohttp://duckduckgo.com/?q=pw http://duckduckgo.com/?q=pw
- spydez 18y agoI prefer https://www.grc.com/passwords.htm https://www.grc.com/passwords.htm for my random password generation needs...
- notdarkyet 18y agoSeems like a spam account. Created 10 minutes ago to promote duckduckgo.com.
- epi0Bauqu 18y agoNo, it's not. I built this special page into the search engine because I generate random usernames and passwords for every site I use, e.g. epi0Bauqu. I was picking up a friend (Todd V., long time lurker) for lunch, and he showed me the post since he uses the pwgen feature as well. I didn't know my password by heart, so he finally created an account and made the post.
- notdarkyet 18y agoI apologize then for the accusation, but for the sake of submitting better comments an explanation (even what you just wrote) would be much better than just submitting a link with no further rationale for submission.
- epi0Bauqu 18y agoAgreed. Perhaps I should have written it for him :) Still not sure why it is getting voted down to -1 though, now that an explanation is under it.
- tptacek 18y agoOnly a tiny fraction of users are ever going to find out what a password manager is, so you really haven't addressed the article's point.