3 ms·
Honestly, I don't get why a service would enforce a password policy at all. They should warn users about what makes a good password, and tell them when their p
by ozh 12y ago
Honestly, I don't get why a service would enforce a password policy at all.
They should warn users about what makes a good password, and tell them when their password sucks ("your password is weak and would be crackable in 3 minutes") but if someone wants for some reason to use 123456 as a password, that's their own problem.
- thisishugo 12y agoFor services where a user can only access their own account, I mostly agree. But sometimes one users' bad security practices can compromise other people's security, too. If you're sharing confidential data with other people - for example, via SpiderOak[0] - and any one of those people's accounts are "hacked," it doesn't matter how good your password is. [0] I'd say Dropbox, but you shouldn't be putting confidential data in Dropbox.
- gkya 12y agoThe easiest answers I can intuit are a) space concerns and b) passwords being stored unencrypted. I reckon point a is valid because malicious users may attack the provider with very long passwords via creating bogus accounts, to disrupt the service; and b is valid because if the developers are lazy enough to store unencrypted passwords away, likely they are to defend against injection attacks via disallowing characters like (').