4 ms·
The number one problem with passwords is that most websites are not storing them using current state-of-the-art methods that are freely available. Whether or no
by ZoFreX 14y ago
The number one problem with passwords is that most websites are not storing them using current state-of-the-art methods that are freely available. Whether or not this is an improvement, it doesn't solve the actual problem - developers aren't going to suddenly start using this if their current method is md5(password).
That said, it does sound quite interesting from a crypto geek perspective.
- 7952 14y agoWe always assume that users are going to make security mistakes and build around that. We should assume the same about developers and stop expecting them to build secure sites. That is how the web actually is already, and it is unlikely to change any time soon.
- 0003 14y agoHas there been paper, or for that matter a blog-post with a napkin calculation, on the cost-benefit of a proper password/authorization system versus a non-robust system discounted for reputation loss / legal liability for system compromises? I did a few google queries but came up empty. I think this would make for a great PSA.
- nathan_long 14y ago>> We always assume that users are going to make security mistakes and build around that. We should assume the same about developers and stop expecting them to build secure sites. I don't follow you. In the first sentence, the "we" is developers of web sites, right? Who is the "we" in the second half? Who are you suggesting should assume developers will make mistakes, and what can/should be done to mitigate that? One possible interpretation is that the second "we" is users, and as a user, yes, I do assume that sites will make mistakes. One reaction is not re-using passwords. But if the user and the site are both naive, I don't see who is left to keep the wolves out.
- 7952 14y agoSorry my comment was inarticulate. I am arguing for a collective sense of mistrust regardless of who you are.