3 ms·
We always assume that users are going to make security mistakes and build around that. We should assume the same about developers and stop expecting them to bu
by 7952 14y ago
We always assume that users are going to make security mistakes and build around that. We should assume the same about developers and stop expecting them to build secure sites. That is how the web actually is already, and it is unlikely to change any time soon.
- 0003 14y agoHas there been paper, or for that matter a blog-post with a napkin calculation, on the cost-benefit of a proper password/authorization system versus a non-robust system discounted for reputation loss / legal liability for system compromises? I did a few google queries but came up empty. I think this would make for a great PSA.
- nathan_long 14y ago>> We always assume that users are going to make security mistakes and build around that. We should assume the same about developers and stop expecting them to build secure sites. I don't follow you. In the first sentence, the "we" is developers of web sites, right? Who is the "we" in the second half? Who are you suggesting should assume developers will make mistakes, and what can/should be done to mitigate that? One possible interpretation is that the second "we" is users, and as a user, yes, I do assume that sites will make mistakes. One reaction is not re-using passwords. But if the user and the site are both naive, I don't see who is left to keep the wolves out.
- 7952 14y agoSorry my comment was inarticulate. I am arguing for a collective sense of mistrust regardless of who you are.