Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Why even let users set their own passwords?

devever.net

Post reply on HN
Print view View original

31–40 of 392 posts

Re: Why even let users set their own passwords?

#31

Post by charrondev »

38 wrote: post #16

> Rather than allowing a user to set their own password, passwords can be issued in exactly the same way as API keys are now: a high-entropy password is randomly generated by the issuing website, and the user is shown the password once only and asked to record it. If the password is lost, a new password must be generated using the same process. The user cannot choose their password, but can get a new randomly generat…

I don’t push with any access token, I push with SSH keys.

An alternative IIRC is to a UI client like GitHub Desktop which lets you login/SSO everything like that, although I’m not sure if that only works because my SSH credentials are configured.

Re: Why even let users set their own passwords?

#32

Post by haunter »

I play a japanese gacha game and there is no password there for your account. If you want to login they send you a code to your email and then you use that (valid for 30 seconds). I'm not a security expert but I always liked that for some reason

Re: Why even let users set their own passwords?

#34

Post by xcxcx »

tylerrobinson wrote: post #29
xcxcx wrote: post #22

Earlier quoted context omitted.

[flagged]

Using economics terminology doesn’t make this insensitive opinion any more valid. Technology is for people, not the other way around.

Nobody gets to decide what's more or less sensitive. Younger generations can argue being rendered homeless due to mass housing affordability issues is also insensitive.

Re: Why even let users set their own passwords?

#35

Post by cm2012 »

samwillis wrote: post #5

We probably will stop one day, but that day isn't yet for many services. There are people who would be unable to use those services if that can't set the password to either the same or a variant of one they always use. In the tech wold we often forget that there is a wide disparity in people's ability to use tech. Take my father, there is no way he could use a password manager, or two factor, it's just never going to…

It's not just old people. I'd say 80% of people would not use a website with that system.

Re: Why even let users set their own passwords?

#36

Post by londons_explore »

lolinder wrote: post #19

> Often this will be combined with fallacious notions such as “remember this device”, the idea being you only have to go through all this the first time when logging in from a particular device. This idea is fallacious because the web has no notion of a “device”, and this is a very intentional design choice made for privacy purposes. We are literally living through the gradual phase-out of third-party cookies, amongs…

I kinda wish there was something like cookies, but even more persistent. Lets call them permacookies.

I want to "remember my device", and have that keep me logged in forever with a permacookie. I don't even want to have a username and password. I want to create an account and be forever logged in.

There would be mechanisms to backup my permacookies, or transfer them to other devices. I'd have control of which sites could set permacookies for when I didn't want to be tracked too.

Re: Why even let users set their own passwords?

#37

Post by FredPret »

xcxcx wrote: post #22
samwillis wrote: post #5

We probably will stop one day, but that day isn't yet for many services. There are people who would be unable to use those services if that can't set the password to either the same or a variant of one they always use. In the tech wold we often forget that there is a wide disparity in people's ability to use tech. Take my father, there is no way he could use a password manager, or two factor, it's just never going to…

[flagged]

Yeah, shape up and learn to code, grandma!

In all seriousness, tech must adapt to humans. Engineers are at their best when they aren’t dictators

Re: Why even let users set their own passwords?

#38

Post by _8j50 »

I guess the author doesn't know but setting password for users used to be more common. They would put it on a sticky under their keyboard or something(i did it myself too and I was in IT at the time, didn't give a shit, getting locked out every other day was affecting my perfrormance/metrics).

The latesr NIST guidline is goes further by eliminating password complexity and focusing memorable high-entropy passphrases. This is a "what you know" auth factor, even with password managers in play, the master password for that or for your high-impact sso password (work sso that can access everything) should ideally be stored only in your head.

But if the author insists, users should be given printed password books and enable MFA.

Re: Why even let users set their own passwords?

#39

Post by CrampusDestrus »

simias wrote: post #28
CrampusDestrus wrote: post #3

Here's why: the world is not able bodied Americans, so let us decide what password is best for us through our input methods

Can you specify what in practice could be an issue with a "forced" password? Are some characters harder to input than others or is it a different problem? For the non-American aspect, it's extremely common for websites to force ASCII today (either explicitly, or because using anything else breaks in various unexpected ways) anyway, I doubt that any internet user around the globe will have an issue with that. That boa…

in my locale's keyboard, curly brackets and the dollar sign are not obvious to input. they require an additional combo of keys that most people have no idea about.

Re: Why even let users set their own passwords?

#40

Post by [deleted] »

xcxcx wrote: post #22
samwillis wrote: post #5

We probably will stop one day, but that day isn't yet for many services. There are people who would be unable to use those services if that can't set the password to either the same or a variant of one they always use. In the tech wold we often forget that there is a wide disparity in people's ability to use tech. Take my father, there is no way he could use a password manager, or two factor, it's just never going to…

[flagged]

[deleted]
Post reply on HN