301–310 of 392 posts
> There's not really a good reason for a user to be able to set their own password unless they want to set their password to something lower in entropy to make it memorable, or reuse it between sites, both of which are deviations from the “best practice” password safe usage model. Yeah, but at the same time if you keep loosing access to your accounts because you can’t remember your password, you are just 1FA with you…
This is basically exactly what WebAuthN/Passkeys is, right?
I've said it before and I'll say it again (and yes let it rain downvotes): I don't understand this whole discussion and maligning of passwords. You cannot save all people. Some fixed %-age of people will always become victims - either by choosing a terrible password or by being shot in the foot by some terribly complex 5FA device-based passphrase scheme that attempts to protect them but ends up betraying the user onc…
I can count on one hand the services that are critically important enough to warrant unique passwords and good practices anyway.
All the other services I have accounts for? I literally can't care if some yahoo in WhereTheHellistan wants to and does get in, there's nothing valuable in there. They all get the same, simple, short password because that's the value of the things behind the password.
Yes, this means all of you reading this are quite welcome to try and steal this HN account guarded by the same, simple, short password. I don't care, all you'll be getting are worthless shitposts and things of similar value in any other services you can find and breach with the same credentials.
The company I work for currently gave me my password, comprised of four space-separated words, on my first day. It has no expiry and can only be changed at request or if compromised. My only gripe with this approach is that my specific password is a bit awkward to type. I tend to pick passwords at least partly based on "keyboard feel" and it's annoying that there's one word that has a lot of repetition of colocated l…
correct horse battery staple?
https://www.explainxkcd.com/wiki/index.php/936:_Password_Str...
Earlier quoted context omitted.
By git client, do you mean something other than git? Something like a CI system? Even there you can use an SSH key?
I think they mean a desktop GUI application on top of git like GitKraken or SourceTree. These sometimes allow you to perform actions like creating a PR (which is not done via git itself, of course).
> but you still need a Personal Access Token to integrate pull requests and issues with your Git client
> Often this will be combined with fallacious notions such as “remember this device”, the idea being you only have to go through all this the first time when logging in from a particular device. This idea is fallacious because the web has no notion of a “device”, and this is a very intentional design choice made for privacy purposes. We are literally living through the gradual phase-out of third-party cookies, amongs…
The author is Hugo Landau, so of course it is a bad take, how else could it be. The real question at this point is why his terrible takes reach the front page every two weeks…
> Often this will be combined with fallacious notions such as “remember this device”, the idea being you only have to go through all this the first time when logging in from a particular device. This idea is fallacious because the web has no notion of a “device”, and this is a very intentional design choice made for privacy purposes. We are literally living through the gradual phase-out of third-party cookies, amongs…
I dont agree with you that it's the user's fault. The issue isn't understanding of remember this device feature. The issue is it's a fundamentally broken design. One, because users have multiple devices and second, the feature is crippled when employing privacy preserving behavior. I should be able to authenticate by proving access to a device such as a yubikey, as an example. Now, the site can properly remember the…
Queen, please. I have no objection for people choosing the "forget my device" option, but the nonsensical whining about explicitly choosing this option and then bemoaning that a website doesn't remember you is absurd.
I play a japanese gacha game and there is no password there for your account. If you want to login they send you a code to your email and then you use that (valid for 30 seconds). I'm not a security expert but I always liked that for some reason
It works but it's incredibly heavyweight. For every login you use an entire email infrastructure, doing all the email "security" processes. That a great deal of work.
Instead of eliminating passwords, they are added to something else to get 2FA.
Earlier quoted context omitted.
I'd wager that >99% of all burglaries are looking for physical possessions which can be sold for a quick buck. Not looking for random notebooks of passwords. So locking it in a safe might not be optimal because it will be like putting a spotlight on it.
Something like 90% of burglaries are looking for car keys. That's why I keep my keys by the front door in eyesight on anyone who comes in. I have insurance, and don't want a thug wandering around my house.