4 ms·

I'd like to jump all over Jeff for having a weak password, but somehow that seems like blaming the victim. Sure, he's supposed to be an elite hacker programmer

I'd like to jump all over Jeff for having a weak password, but somehow that seems like blaming the victim. Sure, he's supposed to be an elite hacker programmer blogger authority something-or-other, but is everyone in the world supposed to become an authority on choosing strong passwords? Stepping back for a moment, why are we using passwords for authentication and security in 2009?

biohacker42 18y ago
Sure, he's supposed to be an elite hacker programmer No, he is not. He is at best average. A while back Joel published an article in Inc, about his experience of run and gun with stackoverflow. He was surprised how well it went. In fact it merely appeared to have gone smoothly. I'm guessing more subtle long term problems will continue to appear as time goes on. And yet still, I think stackoverflow is much much better then experts exchange.
- kaens 18y ago
  No, he is not. He is at best average. I agree, but he is perceived as being some elite coder by a large portion of pretty fresh web-devs, probably mostly because of the prevalence of his blog, and the readers lack of technical skill/knowledge. I know that I thought that he must have known what he was talking about a while ago. That is, before I knew what I was talking about.
tsally 18y ago
Because there are not better alternatives? Unless you'd like to trust some company with biometric details about yourself. But biometrics aren't notably better than passwords anyway. And in answer to your question, yes. Everyone is supposed to become an authority on choosing strong passwords. I fail to see why this is unreasonable.
- raganwald 18y ago
  > Everyone is supposed to become an authority on choosing strong passwords. I fail to see why this is unreasonable. peopel have been saying this for decades, that users should get with it and learn how to create passwords like "as723HASD-23", to change it every month, to use a different one for each system, to never write it down, and so on and so on. And for decades users haven't been doing this. So. Are we to blame the rest of the universe for not doing what we tell it? Or decide for ourselves that This doesn't work and we as programmers must think of something else? If none of the alternatives appeal to you, think up a new one and get some YC funding going :-)
  - tsally 18y ago
    The point is that there are no alternatives. This isn't a design problem that as programmers we can fix. There are plenty of existing security systems that fit the bill. It's a human problem. For example, one technical fix is a widely deployed public key authentication system. It would take a company as large as Google to force people to adopt it, however. Plus operating systems would have to start shipping the software to make the average user understand it. Private key creation would need to be integrated into the create user process of Windows and Mac OS X. That's not realistic because there is little profit for the companies involved.
    - _pius 18y ago
      It would take a company as large as Google to force people to adopt it, however. I think we'd see quite a bit of progress if OpenID providers just started using PKI.
      - lucumo 18y ago
        How many non-technical people are actually using OpenID? (For that matter, how many _technical_ people are using it?) Actually using it, not having some OpenID thing that they don't know about...
        _pius 18y ago
        Why does it matter?
  - axod 18y ago
    There's about a billion password managers out there, that pick secure passwords and remember them for you.

biohacker42 18y ago

Sure, he's supposed to be an elite hacker programmer No, he is not. He is at best average. A while back Joel published an article in Inc, about his experience of run and gun with stackoverflow. He was surprised how well it went. In fact it merely appeared to have gone smoothly. I'm guessing more subtle long term problems will continue to appear as time goes on. And yet still, I think stackoverflow is much much better then experts exchange.

kaens 18y ago
No, he is not. He is at best average. I agree, but he is perceived as being some elite coder by a large portion of pretty fresh web-devs, probably mostly because of the prevalence of his blog, and the readers lack of technical skill/knowledge. I know that I thought that he must have known what he was talking about a while ago. That is, before I knew what I was talking about.

tsally 18y ago

Because there are not better alternatives? Unless you'd like to trust some company with biometric details about yourself. But biometrics aren't notably better than passwords anyway. And in answer to your question, yes. Everyone is supposed to become an authority on choosing strong passwords. I fail to see why this is unreasonable.

raganwald 18y ago
> Everyone is supposed to become an authority on choosing strong passwords. I fail to see why this is unreasonable. peopel have been saying this for decades, that users should get with it and learn how to create passwords like "as723HASD-23", to change it every month, to use a different one for each system, to never write it down, and so on and so on. And for decades users haven't been doing this. So. Are we to blame the rest of the universe for not doing what we tell it? Or decide for ourselves that This doesn't work and we as programmers must think of something else? If none of the alternatives appeal to you, think up a new one and get some YC funding going :-)
- tsally 18y ago
  The point is that there are no alternatives. This isn't a design problem that as programmers we can fix. There are plenty of existing security systems that fit the bill. It's a human problem. For example, one technical fix is a widely deployed public key authentication system. It would take a company as large as Google to force people to adopt it, however. Plus operating systems would have to start shipping the software to make the average user understand it. Private key creation would need to be integrated into the create user process of Windows and Mac OS X. That's not realistic because there is little profit for the companies involved.
  - _pius 18y ago
    It would take a company as large as Google to force people to adopt it, however. I think we'd see quite a bit of progress if OpenID providers just started using PKI.
    - lucumo 18y ago
      How many non-technical people are actually using OpenID? (For that matter, how many _technical_ people are using it?) Actually using it, not having some OpenID thing that they don't know about...
      - _pius 18y ago
        Why does it matter?
- axod 18y ago
  There's about a billion password managers out there, that pick secure passwords and remember them for you.