Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Why even let users set their own passwords?

devever.net

Post reply on HN
Print view View original

161–170 of 392 posts

Re: Why even let users set their own passwords?

#161

Post by Kwpolska »

SoftTalker wrote: post #116
simonw wrote: post #44

Earlier quoted context omitted.

Honestly that feels like what apps are. One of the most compelling reasons to install an iOS app for something like an online bank is so that I won't have to worry about my cookies expiring and forcing me to login again.

My banking app makes me log in every time. I prefer that, but I didn't realize some apps don't do that?

My banking apps ask only for my fingerprint, or a short PIN if biometrics are not available. You could call that “logging in”, but it’s certainly not as serious of a log-in as you would have on the web (with a username and a password, and if the computer is unrecognized, authentication on the phone).

Re: Why even let users set their own passwords?

#162

Post by simias »

CrampusDestrus wrote: post #39
simias wrote: post #28

Earlier quoted context omitted.

Can you specify what in practice could be an issue with a "forced" password? Are some characters harder to input than others or is it a different problem? For the non-American aspect, it's extremely common for websites to force ASCII today (either explicitly, or because using anything else breaks in various unexpected ways) anyway, I doubt that any internet user around the globe will have an issue with that. That boa…

in my locale's keyboard, curly brackets and the dollar sign are not obvious to input. they require an additional combo of keys that most people have no idea about.

Yeah that's a good point, I definitely that automatically generated passwords should be limited to alnum, using symbols is asking for trouble.

Re: Why even let users set their own passwords?

#163

Post by radicality »

CyberRage wrote: post #113

There is one incorrect statemement that really bothered me TOTP and passwords are not the 'similar' because TOTP is a secret generated from the 'key' and is only valid for a short time period this make usage of that secret vastly more challenging for attackers, especially at scale. I've seen real attacks where passwords are stolen, it is impossible to keep track of that. However for TOTP since the attacker has to log…

My understanding of the post was the the author means that from the point of view of “authenticate this user”, the TOTP _key/seed_ is quite similar to a password, which I would agree with. Especially if you’re storing both in your password manager like the OP.

Re: Why even let users set their own passwords?

#165

Post by zuppy »

londons_explore wrote: post #36
lolinder wrote: post #19

> Often this will be combined with fallacious notions such as “remember this device”, the idea being you only have to go through all this the first time when logging in from a particular device. This idea is fallacious because the web has no notion of a “device”, and this is a very intentional design choice made for privacy purposes. We are literally living through the gradual phase-out of third-party cookies, amongs…

I kinda wish there was something like cookies, but even more persistent. Lets call them permacookies. I want to "remember my device", and have that keep me logged in forever with a permacookie. I don't even want to have a username and password. I want to create an account and be forever logged in. There would be mechanisms to backup my permacookies, or transfer them to other devices. I'd have control of which sites c…

we already do have that and needs no certificates or other complex things for the end user: https://developer.mozilla.org/en-US/docs/Web/API/Window/loca...

is it secure? hell no, but it can be used.

Re: Why even let users set their own passwords?

#166

Post by ricree »

robobro wrote: post #153
lolinder wrote: post #19

> Often this will be combined with fallacious notions such as “remember this device”, the idea being you only have to go through all this the first time when logging in from a particular device. This idea is fallacious because the web has no notion of a “device”, and this is a very intentional design choice made for privacy purposes. We are literally living through the gradual phase-out of third-party cookies, amongs…

> My own browser erases all cookies from an origin immediately after the last tab from that origin is closed, Sounds like a you problem, dude. You have to go out of your way to force this behavior with any mainstream browser.

The text you're replying to is part of a long quote from the linked article, not a statement by the person you replied to.

Re: Why even let users set their own passwords?

#167

Post by romwell »

seabass-labrax wrote: post #134
jdthedisciple wrote: post #63

I've said it before and I'll say it again (and yes let it rain downvotes): I don't understand this whole discussion and maligning of passwords. You cannot save all people. Some fixed %-age of people will always become victims - either by choosing a terrible password or by being shot in the foot by some terribly complex 5FA device-based passphrase scheme that attempts to protect them but ends up betraying the user onc…

You cannot save all people - too true. But remember that you, actually all of us, are indirectly the victim of other peoples' mistakes: - we lose contact with people because they get locked out of their email - we pay more in bank account fees to subsidise fraud compensation - we have our personal information stolen because others chose weak passwords Given how much we suffer from other peoples' poor choices, there i…

>- we lose contact with people because they get locked out of their email

I've been locked out of my email because Google insists that "we don't recognize your device", and locked out of my other accounts because my phone was stolen, not because I didn't remember my password.

People forgetting passwords isn't a problem that's solved with other schemes. It's a problem that's exacerbated by them.

>- we pay more in bank account fees to subsidise fraud compensation

Bank account fees, seriously? I can't remember the last time I've paid any.

In any case, worrying about saving the banks a few bucks is dead last on my list of worries.

>- we have our personal information stolen because others chose weak passwords

If our info can be stolen because someone else chose a weak password, the weak password isn't the problem. It's the system that was badly designed in the first place.

>Given how much we suffer from other peoples' poor choices,..

We don't.

>By analogy, we all benefit from fences by cliffs

The analogy doesn't hold because you have to first show that alternatives to passwords are better for the users, even those in the category you mention.

Re: Why even let users set their own passwords?

#168

Post by kelnos »

SoftTalker wrote: post #142
tomsmeding wrote: post #117

Earlier quoted context omitted.

It would be easier for you, who (I suspect) has, like most of us here on HN, a good understanding of what happens on a computer, how to control that, how to manage their software, how to be aware of what is on the foreground when and taking input when. How to recognise various applications and seeing the difference between materially different ones that try to look the same. Your notebook will look markedly different…

I think you sell older people short on what they are and aren't aware of. I think it's more that they see computer technology as a necessary annoyance of the modern world and not anything helpful. They used to manage their bank balance on a ledger in the back of their checkbook, and that seems easier to them than having to sit down in front of the computer or use an app on a small screen that's constantly throwing po…

> There is no online payment method I've seen that seems easier to me than just writing a check.

Autopay. I only pay one bill manually, twice a year, because they don't allow autopay (property taxes). Otherwise I just don't think about it.

Sure, you may not like autopay for whatever reason, but that's a choice. The option is there.

Re: Why even let users set their own passwords?

#169

Post by samwillis »

anderspitman wrote: post #144
samwillis wrote: post #130

Earlier quoted context omitted.

Is the cost of lung cancer lower than smoking? Some people will just never change a behaviour.

I find there are generally two reasons people use analogies. The first is to make a concept easier to understand. The second is to subtly change what is being argued in order to make their position seem stronger. I did the second for years without realizing what I was doing, and still fall into the trap.

Or the third to to illustrate the argument in another context.

I usually avoid analogies of HN as you are often called out on the technicalities of them. And you are right that can often damage an argument.

However, I have argued that changing peoples behaviour, even when their current behaviour is bad for them, is often impossible despite all evidence, from the beginning.

Re: Why even let users set their own passwords?

#170

Post by iknowstuff »

londons_explore wrote: post #75
simonw wrote: post #44

Earlier quoted context omitted.

Honestly that feels like what apps are. One of the most compelling reasons to install an iOS app for something like an online bank is so that I won't have to worry about my cookies expiring and forcing me to login again.

I hate the fact that if you lose your phone and restore to a new one, suddenly every app is logged out again. Like can't the login-state be part of the backup? If I was logged in when the backup was taken, I should still be logged in when restored to a new device.

I think if you do an encrypted itunes backup to your mac, they should remain signed in
Post reply on HN