8 ms·

I work on websites in drupal and so I've both given thought to this problem and seen how the process works from the inside. The problem with random passwords is

I work on websites in drupal and so I've both given thought to this problem and seen how the process works from the inside. The problem with random passwords is that they are impossible to remember, so you have to have your password file with you all the time if you want to be able to access those sites from another computer. The lack of a standardized registration form is not likely to change as long as sites manage their own accounts. However, perhaps there is some way that accounts and registration could be outsourced to a third party. It would have to be a company, or perhaps some not-for-profit entity, that did account management as their only business, so that they weren't just trying to use it as a vehicle to advertise their other business or sell your data, like Facebook. If it was simple, streamlined, and effective for both site owner and user, it could become a de facto standard.

bachmeier 12y ago
The easy solution is to use https://lastpass.com/ https://lastpass.com/ Even if for some reason you don't trust it for your most critical passwords, you can use it to fill in details and generate a password for random sites.
- sparkie 12y ago
  Don't trust that company with your data, trust this one instead! This is never the solution. The solution is to abstain from services which need your data, and which don't give you the source code of the software so that you can verify whether or not it does what they say it does. Try instead: KeePassX, or KeePass2
  - bachmeier 12y ago
    Do you know anything about LastPass? You don't trust them with your data because they don't have access to it: https://lastpass.com/how-it-works/ https://lastpass.com/how-it-works/
- mtdewcmu 12y ago
  I've heard of Lastpass, but, as far as I know, it only solves one problem, namely giving users a place to keep a password list that can be accessed through the web.
  - bachmeier 12y ago
    There are a number of ways to use it. Three of them are: - Saving your username and password and then filling in the details when you visit the site. - Keeping secure notes for things like security questions (or anything else you want) - Filling in information on registration forms. Encryption and decryption take place on your computer. The only thing that goes to LastPass is the encrypted information. They have no way to see what you're storing on their servers. That's why you're out of luck if you lose your password. The biggest advantage to me is that I want to generate unique passwords like %T124_tatWE4%%^&Tx-234rq for each registration, but there's no way I could possibly remember them, so I'd be forced to carry a written copy everywhere. That's not very secure so I reuse semi-safe passwords instead. With LastPass I generate a unique 16-character password and never have to remember it.
    - mtdewcmu 12y ago
      LastPass is better-implemented than I thought, then. You should be able to trust it. That addresses some of the inconvenience of account proliferation, but not all.
csixty4 12y ago
There were a lot of solutions to this in the early 2000s, the golden age of the digital identity ecosystem. I did my bachelor's thesis on the issues faced by a solution that respected Cameron's Laws of Identity in 2003, shortly before the whole scene died off. There were simple, streamlined solutions for this a decade ago. Nobody used them and many of them died. Some still exist out there like zombies. I was shocked to see inames.net is still out there. The example I usually bring up is Windows CardSpaces, which shipped with Windows as recently as Windows 7. It was easy for people to get conceptually. It was easy for site admins to implement. But it never went anywhere. When I talked to people about identity solutions like this, there were problems on both ends. From the user side, an identity solution needed to solve an obvious problem and/or be easier than the status quo. For many users, the status quo is to give out personal information freely and use the same username/password everywhere. Anything that adds choices or variety to the process is too much friction for little perceived benefit. Even if the actual process is simpler (clicking a card) than the status quo (filling out a form), there's a mental cost in adapting to something new. For site owners, there was the added difficulty of educating and supporting users about the new identity solutions. But, the real biggie was that they'd lose the ability to collect & sell all that personal data. That can be more profitable than advertising, and it's a revenue stream some sites can't live without.
- mtdewcmu 12y ago
  Well, the solutions offered then have failed, but did they systematically rule out all possible technologies and business models? One problem is username and password proliferation. Another is filling out the same information over and over, like phone number, email address, and so on. E-commerce sites will often not bother checking email addresses and not require accounts because unnecessary obstacles drive potential customers away. I don't have a preconceived idea of what a 3rd-party account system should do. It could be anywhere from the least amount that would get a webmaster to install it up to a full username and password. Somewhere in there must be something better than the status quo.
  - csixty4 12y ago
    > Well, the solutions offered then have failed, but did they systematically rule out all possible technologies and business models? Of course not. In fact, business models were only considered tangentially in most cases because the general goal was to create an ecosystem of federated identity providers transacting over open protocols. Differentiation would come from the relationship between customers and their providers - charging for background checks to add extra confidence to third-party claims, for example. Or, by selling enterprises more secure identity claim brokers for their employees. > One problem is username and password proliferation. Another is filling out the same information over and over, like phone number, email address, and so on. E-commerce sites will often not bother checking email addresses and not require accounts because unnecessary obstacles drive potential customers away. I'd love to see the Digital Identity discussion revived, and between high-profile security breaches (Adobe, Target...) and the NSA, I think it might be time. I know you don't have or necessarily want a preconceived idea of what a 3rd-party account/identity provider should be, but I encourage you to look at what's been done & discussed before. Dick Hardt's keynote from the 2006 Identity 2.0 conference is entertaining and informative: https://www.youtube.com/watch?v=RrpajcAgR1E https://www.youtube.com/watch?v=RrpajcAgR1E - it's also the talk that got me hooked on Vanilla Stoli for a couple of years. Kim Cameron's "Laws of Identity" were the cornerstone of the discussion back them. They outline a system of federation, user control & consent, and minimal disclosure. Cameron's site also has lot of information about CardSpace/InfoCards (the open standard) and his blog covers some more modern Identity systems from Microsoft: http://www.identityblog.com/stories/2004/12/09/thelaws.html http://www.identityblog.com/stories/2004/12/09/thelaws.html Chris Love's 2007 post-mortem on OpenID and CardSpace: http://love2dev.com/#!article/The-Identity-Crisis--Are-CardSpace-and-OpenId-Viable- http://love2dev.com/#!article/The-Identity-Crisis--Are-CardS... I guess it would also be good to look at tools like 1Password which can fill out registration forms and passwords already, and see why they haven't been adopted more widely.

bachmeier 12y ago

The easy solution is to use https://lastpass.com/ https://lastpass.com/ Even if for some reason you don't trust it for your most critical passwords, you can use it to fill in details and generate a password for random sites.

sparkie 12y ago
Don't trust that company with your data, trust this one instead! This is never the solution. The solution is to abstain from services which need your data, and which don't give you the source code of the software so that you can verify whether or not it does what they say it does. Try instead: KeePassX, or KeePass2
- bachmeier 12y ago
  Do you know anything about LastPass? You don't trust them with your data because they don't have access to it: https://lastpass.com/how-it-works/ https://lastpass.com/how-it-works/
mtdewcmu 12y ago
I've heard of Lastpass, but, as far as I know, it only solves one problem, namely giving users a place to keep a password list that can be accessed through the web.
- bachmeier 12y ago
  There are a number of ways to use it. Three of them are: - Saving your username and password and then filling in the details when you visit the site. - Keeping secure notes for things like security questions (or anything else you want) - Filling in information on registration forms. Encryption and decryption take place on your computer. The only thing that goes to LastPass is the encrypted information. They have no way to see what you're storing on their servers. That's why you're out of luck if you lose your password. The biggest advantage to me is that I want to generate unique passwords like %T124_tatWE4%%^&Tx-234rq for each registration, but there's no way I could possibly remember them, so I'd be forced to carry a written copy everywhere. That's not very secure so I reuse semi-safe passwords instead. With LastPass I generate a unique 16-character password and never have to remember it.
  - mtdewcmu 12y ago
    LastPass is better-implemented than I thought, then. You should be able to trust it. That addresses some of the inconvenience of account proliferation, but not all.

csixty4 12y ago

There were a lot of solutions to this in the early 2000s, the golden age of the digital identity ecosystem. I did my bachelor's thesis on the issues faced by a solution that respected Cameron's Laws of Identity in 2003, shortly before the whole scene died off. There were simple, streamlined solutions for this a decade ago. Nobody used them and many of them died. Some still exist out there like zombies. I was shocked to see inames.net is still out there. The example I usually bring up is Windows CardSpaces, which shipped with Windows as recently as Windows 7. It was easy for people to get conceptually. It was easy for site admins to implement. But it never went anywhere. When I talked to people about identity solutions like this, there were problems on both ends. From the user side, an identity solution needed to solve an obvious problem and/or be easier than the status quo. For many users, the status quo is to give out personal information freely and use the same username/password everywhere. Anything that adds choices or variety to the process is too much friction for little perceived benefit. Even if the actual process is simpler (clicking a card) than the status quo (filling out a form), there's a mental cost in adapting to something new. For site owners, there was the added difficulty of educating and supporting users about the new identity solutions. But, the real biggie was that they'd lose the ability to collect & sell all that personal data. That can be more profitable than advertising, and it's a revenue stream some sites can't live without.

mtdewcmu 12y ago
Well, the solutions offered then have failed, but did they systematically rule out all possible technologies and business models? One problem is username and password proliferation. Another is filling out the same information over and over, like phone number, email address, and so on. E-commerce sites will often not bother checking email addresses and not require accounts because unnecessary obstacles drive potential customers away. I don't have a preconceived idea of what a 3rd-party account system should do. It could be anywhere from the least amount that would get a webmaster to install it up to a full username and password. Somewhere in there must be something better than the status quo.
- csixty4 12y ago
  > Well, the solutions offered then have failed, but did they systematically rule out all possible technologies and business models? Of course not. In fact, business models were only considered tangentially in most cases because the general goal was to create an ecosystem of federated identity providers transacting over open protocols. Differentiation would come from the relationship between customers and their providers - charging for background checks to add extra confidence to third-party claims, for example. Or, by selling enterprises more secure identity claim brokers for their employees. > One problem is username and password proliferation. Another is filling out the same information over and over, like phone number, email address, and so on. E-commerce sites will often not bother checking email addresses and not require accounts because unnecessary obstacles drive potential customers away. I'd love to see the Digital Identity discussion revived, and between high-profile security breaches (Adobe, Target...) and the NSA, I think it might be time. I know you don't have or necessarily want a preconceived idea of what a 3rd-party account/identity provider should be, but I encourage you to look at what's been done & discussed before. Dick Hardt's keynote from the 2006 Identity 2.0 conference is entertaining and informative: https://www.youtube.com/watch?v=RrpajcAgR1E https://www.youtube.com/watch?v=RrpajcAgR1E - it's also the talk that got me hooked on Vanilla Stoli for a couple of years. Kim Cameron's "Laws of Identity" were the cornerstone of the discussion back them. They outline a system of federation, user control & consent, and minimal disclosure. Cameron's site also has lot of information about CardSpace/InfoCards (the open standard) and his blog covers some more modern Identity systems from Microsoft: http://www.identityblog.com/stories/2004/12/09/thelaws.html http://www.identityblog.com/stories/2004/12/09/thelaws.html Chris Love's 2007 post-mortem on OpenID and CardSpace: http://love2dev.com/#!article/The-Identity-Crisis--Are-CardSpace-and-OpenId-Viable- http://love2dev.com/#!article/The-Identity-Crisis--Are-CardS... I guess it would also be good to look at tools like 1Password which can fill out registration forms and passwords already, and see why they haven't been adopted more widely.