3 ms·

Great insight/writeup but the last bit gets to me: Ultimately, password hints are evil and they add nothing to an online system that can’t be achieved with a s

Great insight/writeup but the last bit gets to me: Ultimately, password hints are evil and they add nothing to an online system that can’t be achieved with a secure password reset feature. It's a classic case of someone criticizing one important feature without suggesting viable alternatives. He might as well have said, Gasoline engines are evil and they add nothing to a world that can't be achieved with a more efficient propellant. Yeah, okay - but what's the more efficient propellant?!?! Password hints aren't "evil" just because (a) Adobe happened to store theirs in plain text, and (b) some users do use seriously identifying information in theirs. Password hints make it fast and easy for an actual user who genuinely needs to reset their password to be able to do so quickly and efficiently. What's the secure password reset feature that Troy alludes to? I missed it.

dingaling 13y ago
> What's the secure password reset feature that Troy alludes to? I've seen a few concepts. One I liked was the selection of two or three images from a gallery. If the user correctly identified the ones he had selected at sign-up then a new password was sent to the registered e-mail address. But any password reset process should ensure that it never links back to the original password. Reset, not recover.
- aestra 13y ago
  There is no way in hell I'm going to remember some pictures I picked at the time I registered which was probably 5 years ago. It isn't going to happen.
willthames 13y ago
I would think that Troy alludes to his very extensive piece detailing how and how not to do password resets. http://www.troyhunt.com/2012/05/everything-you-ever-wanted-to-know.html http://www.troyhunt.com/2012/05/everything-you-ever-wanted-t... I think the point about password hints is that, like secret questions, they typically reduce the security of the account when used by actual users. Alternative approaches protect users from themselves.
troyhunt 13y ago
The viable alternative is in the sentence you quoted: "Ultimately, password hints are evil and they add nothing to an online system that can’t be achieved with a secure password reset feature." Secure password reset.
- ScottWhigham 13y ago
  Oh, pish posh. You could've just as easily said, "The viable alternative is to make password resets secure" and said the same thing. It's doublespeak. It's basically an easy way to say, "There are a lot of different things you can do but I don't feel like taking the time to list each of the options right now."

dingaling 13y ago

> What's the secure password reset feature that Troy alludes to? I've seen a few concepts. One I liked was the selection of two or three images from a gallery. If the user correctly identified the ones he had selected at sign-up then a new password was sent to the registered e-mail address. But any password reset process should ensure that it never links back to the original password. Reset, not recover.

aestra 13y ago
There is no way in hell I'm going to remember some pictures I picked at the time I registered which was probably 5 years ago. It isn't going to happen.

willthames 13y ago

I would think that Troy alludes to his very extensive piece detailing how and how not to do password resets. http://www.troyhunt.com/2012/05/everything-you-ever-wanted-to-know.html http://www.troyhunt.com/2012/05/everything-you-ever-wanted-t... I think the point about password hints is that, like secret questions, they typically reduce the security of the account when used by actual users. Alternative approaches protect users from themselves.

troyhunt 13y ago

The viable alternative is in the sentence you quoted: "Ultimately, password hints are evil and they add nothing to an online system that can’t be achieved with a secure password reset feature." Secure password reset.

ScottWhigham 13y ago
Oh, pish posh. You could've just as easily said, "The viable alternative is to make password resets secure" and said the same thing. It's doublespeak. It's basically an easy way to say, "There are a lot of different things you can do but I don't feel like taking the time to list each of the options right now."