For a login situation with extreme rate limiting (say 3 tries a day) "high entropy" might not involve a lot of randomness. A random 8 character password handed out to a user is overkill. Two random words is overkill. Heck, a single diceware word would take 7 years to guess in that environment. For 100 years you only need something like 4 base32 characters.
Why even let users set their own passwords?
41–50 of 392 posts
Re: Why even let users set their own passwords?
#42> My own browser erases all cookies from an origin immediately after the last tab from that origin is closed
I like this idea, but what browser config does this?
Re: Why even let users set their own passwords?
#43> Often this will be combined with fallacious notions such as “remember this device”, the idea being you only have to go through all this the first time when logging in from a particular device. This idea is fallacious because the web has no notion of a “device”, and this is a very intentional design choice made for privacy purposes. We are literally living through the gradual phase-out of third-party cookies, amongs…
I kinda wish there was something like cookies, but even more persistent. Lets call them permacookies. I want to "remember my device", and have that keep me logged in forever with a permacookie. I don't even want to have a username and password. I want to create an account and be forever logged in. There would be mechanisms to backup my permacookies, or transfer them to other devices. I'd have control of which sites c…
So, like Passkeys / WebAuthn?
Re: Why even let users set their own passwords?
#44> Often this will be combined with fallacious notions such as “remember this device”, the idea being you only have to go through all this the first time when logging in from a particular device. This idea is fallacious because the web has no notion of a “device”, and this is a very intentional design choice made for privacy purposes. We are literally living through the gradual phase-out of third-party cookies, amongs…
I kinda wish there was something like cookies, but even more persistent. Lets call them permacookies. I want to "remember my device", and have that keep me logged in forever with a permacookie. I don't even want to have a username and password. I want to create an account and be forever logged in. There would be mechanisms to backup my permacookies, or transfer them to other devices. I'd have control of which sites c…
Honestly that feels like what apps are. One of the most compelling reasons to install an iOS app for something like an online bank is so that I won't have to worry about my cookies expiring and forcing me to login again.
Re: Why even let users set their own passwords?
#45> API keys are used to secure the highest-stakes APIs that exist today — all of AWS's services, for example. Yet while API keys seem to be considered an entirely reasonable and industry standard design approach,
This is not actually true. API keys are highly disfavored because they are easily stolen, and these days if you try to create an access key in AWS, you'll be shown a screen called "Access key best practices & alternatives" which tries to get you to use something else (such as temporary credentials from the EC2 metadata service). There's even federation between providers now, so for example if you need to access your AWS account from a GitHub Action, you don't need to use API keys (https://docs.github.com/en/actions/deployment/security-harde...)
Re: Why even let users set their own passwords?
#46> Often this will be combined with fallacious notions such as “remember this device”, the idea being you only have to go through all this the first time when logging in from a particular device. This idea is fallacious because the web has no notion of a “device”, and this is a very intentional design choice made for privacy purposes. We are literally living through the gradual phase-out of third-party cookies, amongs…
I kinda wish there was something like cookies, but even more persistent. Lets call them permacookies. I want to "remember my device", and have that keep me logged in forever with a permacookie. I don't even want to have a username and password. I want to create an account and be forever logged in. There would be mechanisms to backup my permacookies, or transfer them to other devices. I'd have control of which sites c…
[deleted]
Re: Why even let users set their own passwords?
#47Earlier quoted context omitted.
I kinda wish there was something like cookies, but even more persistent. Lets call them permacookies. I want to "remember my device", and have that keep me logged in forever with a permacookie. I don't even want to have a username and password. I want to create an account and be forever logged in. There would be mechanisms to backup my permacookies, or transfer them to other devices. I'd have control of which sites c…
Honestly that feels like what apps are. One of the most compelling reasons to install an iOS app for something like an online bank is so that I won't have to worry about my cookies expiring and forcing me to login again.
This is why I hope PWAs take off more. If there is an implicit "save first party cookies forever" for PWAs that have been "installed" and we make them discoverable it's a net win.
Re: Why even let users set their own passwords?
#48For a login situation with extreme rate limiting (say 3 tries a day) "high entropy" might not involve a lot of randomness. A random 8 character password handed out to a user is overkill. Two random words is overkill. Heck, a single diceware word would take 7 years to guess in that environment. For 100 years you only need something like 4 base32 characters.
This isn’t the attack vector to be concerned about. More concerning is when there’s a data breach and an attacker gains access to hashed passwords. At that point, you attack the hash not the API.
This comment is an example of why I wouldn’t want any given website to choose my password.
Re: Why even let users set their own passwords?
#49Earlier quoted context omitted.
[flagged]
Using economics terminology doesn’t make this insensitive opinion any more valid. Technology is for people, not the other way around.
I let people set their own password. This is like canary letter for them to know if anyone accessed their data. If sysadmins need access they take it and go through a new password rotine with the user.
I also have no password requirements (other than non-blank)
I do this because I see it as user centric. I have never had a problem.
One environment requires no privacy expectation. That environment we use simple nouns all in the same category.
All the environments are full SSO they only need to login.
Re: Why even let users set their own passwords?
#50Ok. How about I make up a high entropy password and you use it.