Why even let users set their own passwords?
devever.net
Why even let users set their own passwords?
1–10 of 392 posts
Re: Why even let users set their own passwords?
#2Because for the average user it is still significantly easier to download some app to use in combination with a password they have a mnemonic for rather than having to figure out their own system for storing and retrieving long tokens in a reliable way. Also, most users are not obsessively clearing out their cache, so device recognition based password flows work seamlessly a lot of the time.
Re: Why even let users set their own passwords?
#3Here's why: the world is not able bodied Americans, so let us decide what password is best for us through our input methods
Re: Why even let users set their own passwords?
#4> A given website might obnoxiously refuse to trust in my ability to set a secure password, assume the 24-character randomly generated password I keep in my password safe is insecure, and demand I complete an email challenge every time I login
...because it's easier and cheaper to apply one rule for every user and you're an outlier. Most users don't have password safes - they have passwords like 'Messi123' that they use across multiple sites, and therefore benefit from a second factor since their first factor is more or less non-existent.
Re: Why even let users set their own passwords?
#5We probably will stop one day, but that day isn't yet for many services. There are people who would be unable to use those services if that can't set the password to either the same or a variant of one they always use.
In the tech wold we often forget that there is a wide disparity in people's ability to use tech. Take my father, there is no way he could use a password manager, or two factor, it's just never going to happen. He has a notebook of passwords, that's how he works and he won't change.
We cannot change everyones behaviour, no matter how much it would be better for them. That's a very well learnt lesson, over and over.
The world in 30 years time will be very different, the eldest generations will have grown up with passwords and the internet. Many will have been using password managers, 2 factor, other authentication systems and devices for much of their lives. It's going to be a slow, trickle down change, from "high tech" services down to everyday sites and systems.
Re: Why even let users set their own passwords?
#6[deleted]
Re: Why even let users set their own passwords?
#7How would you share the password with the users without revealing it to others?
How would a users use different devices?
Re: Why even let users set their own passwords?
#8Ikea effect. People are more likely to complete the new user funnel if they felt they had a role in building it.
Re: Why even let users set their own passwords?
#9With passkeys they won’t. Let’s move on already!
Re: Why even let users set their own passwords?
#10There is an overwhelming amount of superfluous text in this article.
The author's solution:
> Rather than allowing a user to set their own password, passwords can be issued in exactly the same way as API keys are now: a high-entropy password is randomly generated by the issuing website, and the user is shown the password once only and asked to record it. If the password is lost, a new password must be generated using the same process. The user cannot choose their password, but can get a new randomly generated one in the event of compromise. The password essentially becomes indistinguishable from an API key.