51–60 of 172 posts
> The number of passwords and the severity of the hack was not uncovered until today. The passwords were stored using unsalted MD5 hashing Enough said. > The most popular password pulled from the Last.fm database was 123456. Seriously, it’s 2016 people Sure, but the breach was in 2012 TechCrunch. Better article: http://www.leakedsource.com/blog/lastfm
Top email domains :
1. hotmail.com 3. yahoo.com 4. aol.com
49th most used password: Blink182
Earlier quoted context omitted.
Password managers already do that, they just check for password type field and the site. Keepass does that pretty sure all the others also do. But again what problem are you trying to solve? using password managers is easy as pie today including automating signup and generating passwords, most people do not use them.
I started using LastPass just the other day because the recent news made me nervous. It's NOT easy. The interfaces are clunky. I have to pay to get some basic features like browser plugin. There's a lot of false positives (it suggests me sometimes to save a password even if the field is not for passwords.) Generating secure passwords is hard because some sites validate length and charset only serverside and the poor…
It does cost to sync across to a mobile device, though.
Most of your signups are not going to generate and store a secure password "just to try you out", as evidenced by the most common password here "123456". If you force people to signup to try your site/app, many (most?) of them are going to use a crap password. If you're _lucky_ that'll be 123456, and not their email/facebook/internet-banking password.
The answer isn't to try and force "good passwords" from users who don't care. Remember, by definition - they don't care.
We need to start trying to not require users to come up with passwords until they do care. Maybe just cookie me and let me tromp around as an unauthenticated user until I do something that needs me to set up a password-protected account. Maybe ask for my email and send me a login link that hooks me into my account/data without me setting a password (lets face it, your password security is going to fundamentally rely on the security of my email account, 'cause your "forgot password" story says you'll happily send a password rest link there, right?
I know Start-up-de-jour desperately needs "signed up user numbers" for their investor pitch, but that's not going to motivate me to stop using 123456 or password123 as a password when startupdejour.io demands I create an account just to look around.
Please get rid of passwords. Thanks.
As a new curious user of your new startup's website, I don't give a damn about being "secure". I've probably given you a fake name and a stupid password just so I can poke around and see if your site sucks any less than the other 5 or 6 new sites desperately craving my attention this morning.
If I can get in and look around without having to lie about my personal details - you're _way_ more likely to get a"proper password" and my real contact details if/when I decide I'm actually gonna add you the the list of "stuff I use" instead of "crap I signed up for once and never went back again" or "site I used a few times but none of my friends signed up so I stopped going there".
Please get rid of passwords. Thanks.
Mozilla Persona could have been another solution – just log in with your browser account – but that got killed.
And in the current web, I’m not sure something like that will ever happen, as the web is moving even more away from universal standards, and towards more and more closed walled gardens.
Ah, looks like I was covered. But hey, now it's an even longer password with even higher entropy, so that's not a bad thing.
Man, I'm getting desensitized to the enormous numbers of accounts whose information gets leaked when a platform gets hacked. 43 million here, 68 million there. I'm semi-joking, but at this point it's almost like I need Facebook or Google level hacks (multiple hundred millions or billions) to actually think, "This is huge ."
Famous last words maybe, but then I'll just change my password?
Regular reminder that new users in general don't care at all about the security of your site. Most of your signups are not going to generate and store a secure password "just to try you out", as evidenced by the most common password here "123456". If you force people to signup to try your site/app, many (most?) of them are going to use a crap password. If you're _lucky_ that'll be 123456, and not their email/facebook…