4 ms·

> 1. Lots of users use the same password on multiple sites I'd never say this at a job interview but I'll be Devil's advocate: As a business, this isn't my pro

> 1. Lots of users use the same password on multiple sites I'd never say this at a job interview but I'll be Devil's advocate: As a business, this isn't my problem, it's yours. If you want the convenience of the same password for multiple sites, in the real world there are going to be weak points on some of those sites and someone who can abuse any point of the chain on any site can obtain your password for all. For the rest, expecting to change my passwords if my phone is stolen is not an unreasonable thing at all. I should do this anyway, even if businesses ensure me that I don't have to. And 99% of users who aren't IT or security professionals would just prefer to be done with entering their password after the first time, period.

thirsteh 13y ago
> I'd never say this at a job interview but I'll be Devil's advocate: As a business, this isn't my problem, it's yours. This argument is the same as saying "It's not my fault you're being spied on because you're not using OTR in your IM; it's yours." You're technically right that the user could theoretically avoid this problem, but you're wrong in practice since you're setting impossible expectations that even security-conscious people often don't meet. It's a service provider's responsibility to not let user credentials be easily accessible because those credentials are used in many places. The latter is a more fundamental issue, yes, but you deserve the flak you get if you just say "not my problem."
ZoFreX 13y ago
Morally yes you are correct (imo). But which product are users going to go for - the one that goes the extra mile to keep them safe and help them out, or the one that doesn't give a damn about them? We have to deal with reality, not ideals, and the reality is that most people do not practice good password management. > 99% of users who aren't IT or security professionals would just prefer to be done with entering their password after the first time, period. Which is just as possible with tokens as it is with passwords. There is no reason not to use tokens.

thirsteh 13y ago

> I'd never say this at a job interview but I'll be Devil's advocate: As a business, this isn't my problem, it's yours. This argument is the same as saying "It's not my fault you're being spied on because you're not using OTR in your IM; it's yours." You're technically right that the user could theoretically avoid this problem, but you're wrong in practice since you're setting impossible expectations that even security-conscious people often don't meet. It's a service provider's responsibility to not let user credentials be easily accessible because those credentials are used in many places. The latter is a more fundamental issue, yes, but you deserve the flak you get if you just say "not my problem."

ZoFreX 13y ago

Morally yes you are correct (imo). But which product are users going to go for - the one that goes the extra mile to keep them safe and help them out, or the one that doesn't give a damn about them? We have to deal with reality, not ideals, and the reality is that most people do not practice good password management. > 99% of users who aren't IT or security professionals would just prefer to be done with entering their password after the first time, period. Which is just as possible with tokens as it is with passwords. There is no reason not to use tokens.