Why even let users set their own passwords? • Hacker News Board

Re: Why even let users set their own passwords?

#141

Post by lolinder » Sat, Jul 22, 2023, 4:04 PM UTC

anderspitman wrote: post #132

lolinder wrote: post #19

> Often this will be combined with fallacious notions such as “remember this device”, the idea being you only have to go through all this the first time when logging in from a particular device. This idea is fallacious because the web has no notion of a “device”, and this is a very intentional design choice made for privacy purposes. We are literally living through the gradual phase-out of third-party cookies, amongs…

I read OP's mention of third party cookies as an example of browsers supposedly moving in a more privacy focused direction, not as being related to authentication.

Well, the weird thing about the phrasing is the claim that third-party cookies are being phased out to "prevent this sort of thing"—where "this sort of thing" is "remember this device".

This is... sorta true? Insofar as creepy advertisers also "remember this device". But a first-party site storing a cookie to remember a login session is not at all in the same category for me.

Re: Why even let users set their own passwords?

#142

Post by SoftTalker » Sat, Jul 22, 2023, 4:05 PM UTC

tomsmeding wrote: post #117

gcanyon wrote: post #88

Earlier quoted context omitted.

> Take my father, there is no way he could use a password manager...He has a notebook of passwords Your father does use a password manager: a slow, very inconvenient one. If you could teach him to reach for ctrl-c/ctrl-v instead of a pencil, it would be easier for him.

It would be easier for you, who (I suspect) has, like most of us here on HN, a good understanding of what happens on a computer, how to control that, how to manage their software, how to be aware of what is on the foreground when and taking input when. How to recognise various applications and seeing the difference between materially different ones that try to look the same. Your notebook will look markedly different…

I think you sell older people short on what they are and aren't aware of. I think it's more that they see computer technology as a necessary annoyance of the modern world and not anything helpful. They used to manage their bank balance on a ledger in the back of their checkbook, and that seems easier to them than having to sit down in front of the computer or use an app on a small screen that's constantly throwing popups in their face, either ads or little "helpful tips" about this month's new features.

I'm getting close to 60, but I've been programming and working with computers since in was in 6th grade. When I was in my 30s, paying my bills meant sitting down at the table once a month with my checkbook, stack of bills, and book of stamps. Open a bill, write a check, put a stamp on the envelope, repeat. It took maybe 15 minutes and was very easy. Compare that to opening a different website, with a different username and password and maybe TOTP code or SMS code, for each bill I need to pay. It's slower and more complicated.

There is no online payment method I've seen that seems easier to me than just writing a check. Of course I rarely write checks these days, so I use the apps and websites and feel annoyed every time I do.

Re: Why even let users set their own passwords?

#143

Post by cubefox » Sat, Jul 22, 2023, 4:06 PM UTC

orev wrote: post #71

samwillis wrote: post #57

Earlier quoted context omitted.

It is when they are all a variant of each other. I can't imagine him successfully writing down a bunch of none alphanumeric characters and not giving up.

A randomly generated pass-phrase can be both secure and easy to remember/write down.

It can, but it's very unlikely. Most randomly generated data doesn't have a memorable structure.

Re: Why even let users set their own passwords?

#144

Post by anderspitman » Sat, Jul 22, 2023, 4:10 PM UTC

samwillis wrote: post #130

anderspitman wrote: post #128

Earlier quoted context omitted.

Is the cost of getting phished really lower than the cost of learning a password manager for your dad?

Is the cost of lung cancer lower than smoking? Some people will just never change a behaviour.

I find there are generally two reasons people use analogies. The first is to make a concept easier to understand. The second is to subtly change what is being argued in order to make their position seem stronger. I did the second for years without realizing what I was doing, and still fall into the trap.

Re: Why even let users set their own passwords?

#145

Post by [deleted] » Sat, Jul 22, 2023, 4:15 PM UTC

anderspitman wrote: post #132

lolinder wrote: post #19

> Often this will be combined with fallacious notions such as “remember this device”, the idea being you only have to go through all this the first time when logging in from a particular device. This idea is fallacious because the web has no notion of a “device”, and this is a very intentional design choice made for privacy purposes. We are literally living through the gradual phase-out of third-party cookies, amongs…

I read OP's mention of third party cookies as an example of browsers supposedly moving in a more privacy focused direction, not as being related to authentication.

[deleted]

Re: Why even let users set their own passwords?

#146

Post by tomsmeding » Sat, Jul 22, 2023, 4:16 PM UTC

SoftTalker wrote: post #142

tomsmeding wrote: post #117

Earlier quoted context omitted.

It would be easier for you, who (I suspect) has, like most of us here on HN, a good understanding of what happens on a computer, how to control that, how to manage their software, how to be aware of what is on the foreground when and taking input when. How to recognise various applications and seeing the difference between materially different ones that try to look the same. Your notebook will look markedly different…

I think you sell older people short on what they are and aren't aware of. I think it's more that they see computer technology as a necessary annoyance of the modern world and not anything helpful. They used to manage their bank balance on a ledger in the back of their checkbook, and that seems easier to them than having to sit down in front of the computer or use an app on a small screen that's constantly throwing po…

I am not at all claiming that all people above a certain age have difficulty with these things! Though it is usually people above, say, 40 who feel this way — and this is not a negative thing: it may well be just because they remember that a different way existed. I.e. most people with tech difficulties are older, but many older people have no tech difficulties.

Though you are also correct that dealing with "technology" today requires a certain level of pain tolerance. Good UX exists but is rare, and authentication is still a mess basically everywhere if you don't want to do OAuth and centralise it to the behemoths. "Poweruser apps" can be extremely empowering, but always have a steep learning curve, sometimes very steep; they can help making your dayjob much easier, but typically help nought with, say, filing your taxes or paying your bills.

Disclaimer: am 25 years old.

Re: Why even let users set their own passwords?

#147

Post by londons_explore » Sat, Jul 22, 2023, 4:19 PM UTC

j5155 wrote: post #96

londons_explore wrote: post #86

Earlier quoted context omitted.

Apple will make sure PWA's aren't successful. They can't risk their control over the app ecosystem.

Are you aware that iOS supports PWAs, and recently implemented notifications for them?

Only 8 years late: https://developer.chrome.com/blog/push-notifications-on-the-...

Besides - there are plenty of other things Apple can do to ensure PWA's don't take off. For example, there is no ability for a web-app to have a "click here to install to desktop" button - the website must try to guide the user into clicking the share button and then creating a desktop icon - which most users don't associate with 'installing' something.

Also, the 50Mb limit on PWA's prevents a lot of usecases - like photo/video editors, and even most messaging apps.

Re: Why even let users set their own passwords?

#148

Post by anderspitman » Sat, Jul 22, 2023, 4:20 PM UTC

ryukoposting wrote: post #93

I appreciate that there is at least one other person on earth who shares my skepticism of many popular MFA implementations. A lot of them add more inconvenience than security. "We sent a code to your email" is particularly heinous.

Other than the chance the email is delayed, and the generally subpar UX, what are your concerns with emailed codes? This is an honest question, as this is the primary login method I settled on for all my services after spending a good chunk of time thinking about this.

Re: Why even let users set their own passwords?

#149

Post by gerbilly » Sat, Jul 22, 2023, 4:29 PM UTC

Cos we want to be able to blame the users when there is a data breach. :-)

Re: Why even let users set their own passwords?

#150

Post by KnobbleMcKnees » Sat, Jul 22, 2023, 4:32 PM UTC

The company I work for currently gave me my password, comprised of four space-separated words, on my first day. It has no expiry and can only be changed at request or if compromised.

My only gripe with this approach is that my specific password is a bit awkward to type. I tend to pick passwords at least partly based on "keyboard feel" and it's annoying that there's one word that has a lot of repetition of colocated letters.

Other than that it's a fantastic model and hugely preferred over routine password resets.