4 ms·
Please see my comment here https://news.ycombinator.com/item?id=9893126 https://news.ycombinator.com/item?id=9893126. I was talking about the referenced articl
by bargl 11y ago
Please see my comment here https://news.ycombinator.com/item?id=9893126 https://news.ycombinator.com/item?id=9893126.
I was talking about the referenced article Microsoft research paper when I said it was not relevant.
- scott_s 11y agoI was also talking about the paper by Cormac Herley from MSR. The lasting value of the paper is not the specific best practices that are not being applied. Those are examples of the claim people are being rational when they ignore security advice. The value in the paper is in the idea that users are acting rationally, and backing that up with some math and concrete examples.
- bargl 11y agoI should not have called the article irrelevant, but instead stated that it needs an update to include modern techniques, practices and risk factors. One of his examples in 7.3 User Effort is not Free he mentions the users time in input of a 6 digit pin vs an 8 digit password. But he doesn't include the use of a password management system. If you use a password managment system you can actually save time on password input. Then look at his section on passwords. The same thing applies. And the article is not security advice but it contains security advice from 2009 which is different today.