4 ms·
I agree with the article's premise, but the user does need to be educated about the risks at the same time. We can enforce some degree of password strength, bu
by smoyer 14y ago
I agree with the article's premise, but the user does need to be educated about the risks at the same time. We can enforce some degree of password strength, but we can't keep the user from reusing the same password. If we could guarantee that their password would never be exposed, that would be fine but I'm never going to make that guarantee.
I can be diligent and yet one mistake can still expose the user's (hopefully salted and hashed) password. If there is a financial impetus for someone to find my mistake, they will spend the time looking.
As a side note, I'd love to hear how the hackers came to be in possession of 6.5MM LinkedIn passwords ... what mistake was made that allowed them to collect unsalted hashes in the first place?
- cpt1138 14y agoI keep hearing about these mysterious hackers. My gut feeling is that with these really big ones that we hear about, its more likely to be some kind of insider threat that they will do everything they can to hide. Blaming "them" with no details at all, seems really sketchy to me.
- dpark 14y ago> we can't keep the user from reusing the same password Neither can the user. Users cannot remember a unique password for every site they visit. That's just not realistic. The simple fact is that unique-password-per-site does not scale. Password managers don't work well, either, because they can't be integrated into the common mobile browsers, and they frankly just require too much user intervention. (Sure, I'll install this plugin on every machine I use, plus the gimpy custom browser for my phone and tablet, and I'll use the app to cut/paste into other apps that need auth...) We really need to big players to get together and build a system that works, and for them to all implement it properly and push 3rd parties to use it. BrowserID seems promising, but I haven't heard of any other big players signing on to implement and support it.
- smoyer 14y agoJeff Atwood has made the same claim and it's his rationale for using OpenID on the StackExchange sites. I don't disagree, but most users won't figure out how to use OpenID. FB login is widely known but it's not at all side-effect free.
- eli 14y agoI also seem to recall it took quite a bit of engineering to get OpenID working properly...
- dllthomas 14y agoGetting OpenID working was pretty trivial; getting additional info from the ID provider (name and whatnot) is messier.
- Splines 14y agoFB seems like the lowest-bar when it comes to usability. Most people have a facebook account, and are familiar with the "app needs your permissions" flow. I'm not familiar with how you write a web-app to use FB authentication - how much does using FB auth obviate the need for you to worry about user credentials?
- polemic 14y agoI just wish everyone didn't take the opportunity to also tap into the 'post to you activity stream, spam your friends' goody bag at the same time. Use FB by all means, but don't fail the auth if the user declines the extras.
- gaius 14y agoNo-one will use FB auth until they can be confident that whatever site isn't going to spew crap all over their wall. There is some truly obnoxious behavior around. Take The Graun, a newspaper in the UK. If you follow a link from FB to their site, they will direct you to login with FB. Then when you do, every time you read a story, they will post that you did on your timeline. Who on Earth would want that?