3 ms·

I have never seen a form auto generate a password, but intrigued by the concept. How would you communicate it to the user? At some point you'd need to send it i

I have never seen a form auto generate a password, but intrigued by the concept. How would you communicate it to the user? At some point you'd need to send it in plain text (not to mention trust they'd remember/record it, unless you're optioning for a 'reset your password ever time' flow)

msohcw 13y ago
Two small icons next to the field, one for autogeneration (a refresh maybe?) and one for password visibility (an eye like IE uses perhaps, a concept common to other software as well.) Keep the generation code in js client side , and send the plaintext to the server via SSL as always. Normal operation of user creation. The plaintext has to be sent at least once over SSL to get hashed on the server side. Hashing on the client side is generally worse because then you'd be more susceptible to MITM attacks. (Actually, either way you'd be more susceptible. Just rely on strong SSL.)
- lstamour 13y ago
  Yes re client side generation though it might not be as random, the point is to encourage people to not use the same password. It could be combined with an educational note "Why use this password?" or "Why should I remember a different password? You don't need to..." Client-side is always MITM friendly without certificate pinning and strong SSL, which is why I have to dial down the paranoia a bit myself: I was just now thinking that you could plant a non-random auto-completed password, but then if you can do that you could just listen for the real password too. (We're assuming you're running JavaScript here after all.)
lstamour 13y ago
Beyond LastPass and such, one long-standing UX implementation is in Mac OS X, when you go to change a user's password. It even has an interesting dialog box, though the pre-selected passwords tend not to be quite random enough for my tastes if pronounceable. A variation of this has appeared in Safari on iOS 7 with iCloud Keychain turned on: Safari will now suggest a password in the autocomplete when you go to fill in a registration form it can recognize. This, while surprising, really does work assuming someone can "save" the password at the same time. (Hence why it's rarely done on the web unless you have such tools, but people more often do these days.)

msohcw 13y ago

Two small icons next to the field, one for autogeneration (a refresh maybe?) and one for password visibility (an eye like IE uses perhaps, a concept common to other software as well.) Keep the generation code in js client side , and send the plaintext to the server via SSL as always. Normal operation of user creation. The plaintext has to be sent at least once over SSL to get hashed on the server side. Hashing on the client side is generally worse because then you'd be more susceptible to MITM attacks. (Actually, either way you'd be more susceptible. Just rely on strong SSL.)

lstamour 13y ago
Yes re client side generation though it might not be as random, the point is to encourage people to not use the same password. It could be combined with an educational note "Why use this password?" or "Why should I remember a different password? You don't need to..." Client-side is always MITM friendly without certificate pinning and strong SSL, which is why I have to dial down the paranoia a bit myself: I was just now thinking that you could plant a non-random auto-completed password, but then if you can do that you could just listen for the real password too. (We're assuming you're running JavaScript here after all.)

lstamour 13y ago

Beyond LastPass and such, one long-standing UX implementation is in Mac OS X, when you go to change a user's password. It even has an interesting dialog box, though the pre-selected passwords tend not to be quite random enough for my tastes if pronounceable. A variation of this has appeared in Safari on iOS 7 with iCloud Keychain turned on: Safari will now suggest a password in the autocomplete when you go to fill in a registration form it can recognize. This, while surprising, really does work assuming someone can "save" the password at the same time. (Hence why it's rarely done on the web unless you have such tools, but people more often do these days.)