4 ms·

No money involved here and (as you are an HN type) you will be using a unique password. Accessing HN from your own devices, then you will probably stay logged

by bdfh42 14y ago

No money involved here and (as you are an HN type) you will be using a unique password. Accessing HN from your own devices, then you will probably stay logged in - so not much to "sniff". Additional security would be all pain with very little gain in my opinion.

drcode 14y ago
That basically answers my question, assuming other HNers agree with you: For my own website I will also have nothing of real value and so there's no real danger if someone gets hacked. The only real danger is for bozos who use the same password for HN as they do for their citibank account...
- manuscreationis 14y ago
  You really need to re-think this attitude toward security. It is absolutely your responsibility, as the developer of your application, to make security of user accounts an absolute priority. It doesn't matter what the purpose of your website is - if you're having users create accounts, you need to secure them as best as you can. It's not ok for you to classify users who have poor password practice as "Bozos". These are your users - your customers - the people who give your application a purpose. Treat them with respect, or let them find someone who will.
- FuzzyDunlop 14y ago
  If your site has nothing of real value, then why are you requiring a login in the first place? Further to that, if someone gets 'hacked' using your service, you've already highlighted that the vulnerability was using your no value service. Don't skimp on basic security. And show your potential users a little less contempt, too. They are not the 'bozos' here.
  - drcode 14y ago
    > They are not the 'bozos' here. Does that make PG the bozo?
  - mustafa0x 14y ago
    Users who have the same password for HN and their bank are indeed bozos.
    - manuscreationis 14y ago
      That isn't the point. No one here is saying that users shouldn't have better password policies. They should. What is being said is that having a devil-may-care attitude toward safe guarding your users account data is not ok. If you use your bank password for anything other than your bank, you're clearly not taking security seriously. If you think you shouldn't have to properly secure user account information, you're clearly not taking security seriously. Both parties can be wrong, but that doesn't excuse either side.
      - mustafa0x 14y ago
        It was the point drcode was making (which FuzzyDunlop misunderstood): > The only real danger is for bozos who use the same password for HN as they do for their citibank account --- Excuse my pedantry, but I'd advise against saying "That isn't the point.", for it conflicts with a well known writing technique: http://en.wikipedia.org/wiki/Show,_don%27t_tell http://en.wikipedia.org/wiki/Show,_don%27t_tell If you insist on doing so, consider a more polite alternative. E.g. "it's seems you've missed the point", "perhaps you've misunderstood", "I feel that so-and-so was saying something else".
- bdfh42 14y ago
  Take a good look at OpenID and oAuth - that way you can offer secure sign up / login without having to manage user passwords - well unless you offer that as an additional option.

by bdfh42 14y ago

drcode 14y ago

That basically answers my question, assuming other HNers agree with you: For my own website I will also have nothing of real value and so there's no real danger if someone gets hacked. The only real danger is for bozos who use the same password for HN as they do for their citibank account...

manuscreationis 14y ago
You really need to re-think this attitude toward security. It is absolutely your responsibility, as the developer of your application, to make security of user accounts an absolute priority. It doesn't matter what the purpose of your website is - if you're having users create accounts, you need to secure them as best as you can. It's not ok for you to classify users who have poor password practice as "Bozos". These are your users - your customers - the people who give your application a purpose. Treat them with respect, or let them find someone who will.
FuzzyDunlop 14y ago
If your site has nothing of real value, then why are you requiring a login in the first place? Further to that, if someone gets 'hacked' using your service, you've already highlighted that the vulnerability was using your no value service. Don't skimp on basic security. And show your potential users a little less contempt, too. They are not the 'bozos' here.
- drcode 14y ago
  > They are not the 'bozos' here. Does that make PG the bozo?
- mustafa0x 14y ago
  Users who have the same password for HN and their bank are indeed bozos.
  - manuscreationis 14y ago
    That isn't the point. No one here is saying that users shouldn't have better password policies. They should. What is being said is that having a devil-may-care attitude toward safe guarding your users account data is not ok. If you use your bank password for anything other than your bank, you're clearly not taking security seriously. If you think you shouldn't have to properly secure user account information, you're clearly not taking security seriously. Both parties can be wrong, but that doesn't excuse either side.
    - mustafa0x 14y ago
      It was the point drcode was making (which FuzzyDunlop misunderstood): > The only real danger is for bozos who use the same password for HN as they do for their citibank account --- Excuse my pedantry, but I'd advise against saying "That isn't the point.", for it conflicts with a well known writing technique: http://en.wikipedia.org/wiki/Show,_don%27t_tell http://en.wikipedia.org/wiki/Show,_don%27t_tell If you insist on doing so, consider a more polite alternative. E.g. "it's seems you've missed the point", "perhaps you've misunderstood", "I feel that so-and-so was saying something else".
bdfh42 14y ago
Take a good look at OpenID and oAuth - that way you can offer secure sign up / login without having to manage user passwords - well unless you offer that as an additional option.