Why even let users set their own passwords? • Hacker News Board

Re: Why even let users set their own passwords?

#331

Post by Eisenstein » Sun, Jul 23, 2023, 3:29 AM UTC

anderspitman wrote: post #320

Eisenstein wrote: post #279

Earlier quoted context omitted.

You don't seem to be 'simply' doing anything. Everything you have posted besides the first comment about phishing is some kind of dodge which uses obvious manipulation tactics, for instance saying 'I do that myself sometimes', which is a cop method for encouraging confessions, or 'you can have the last word' works to actually let you have the last word. Stop doing that.

You're ascribing a ton of ill will here, and I hope you'll give me a little more grace, but on the other hand maybe there is some truth to your words. I'll see if I can communicate more clearly and authentically in the future. Thanks for the opportunity to introspect.

Assuming good faith, I will elaborate:

* to respond to something you don't agree with, in this case a metaphor, perhaps just write "I don't agree with that metaphor" or "let's stick to realistic examples"

* try not to dissect motives unless necessary. The person you responded to made a good point that people will do things against their interests out of habit or convenience -- why does use of a completely legitimate tactic need to be singled out?

* technical people who work with non-technical people (or even who deal with non-technical families and friends and children) are highly accustomed to describing things in simple metaphors

I realize that I have been uncordial and somewhat aggressive with you in this instance, but it made me particularly irked to see someone profess such an amount of self-awareness while showing a profound lack of it.

Either you are (a) just not in your groove mentally at that moment, (b) not as centered as you like to think you are, or (c) playing some kind of game, either consciously or unconsciously. Either way I figured my approach would get a response and hopefully a correction.

I look forward to our next encounter and genuinely hope it starts off on a better footing because you seem like an interesting person.

Re: Why even let users set their own passwords?

#332

Post by gcanyon » Sun, Jul 23, 2023, 3:46 AM UTC

SoftTalker wrote: post #142

tomsmeding wrote: post #117

Earlier quoted context omitted.

It would be easier for you, who (I suspect) has, like most of us here on HN, a good understanding of what happens on a computer, how to control that, how to manage their software, how to be aware of what is on the foreground when and taking input when. How to recognise various applications and seeing the difference between materially different ones that try to look the same. Your notebook will look markedly different…

I think you sell older people short on what they are and aren't aware of. I think it's more that they see computer technology as a necessary annoyance of the modern world and not anything helpful. They used to manage their bank balance on a ledger in the back of their checkbook, and that seems easier to them than having to sit down in front of the computer or use an app on a small screen that's constantly throwing po…

> There is no online payment method I've seen that seems easier to me than just writing a check.

How I paid bills in Thailand:

    1. Bill comes in the mail, with a QR code. Bill says I owe 413 ฿ for power.
    2. I scan the QR code with my phone.
    3. Message comes up from my bank saying, "You want to pay 413 ฿ for your power?"
    4. I tap yes. Bill is paid.

Apart from autopay (mentioned by someone else) it doesn't get simpler than that.

Re: Why even let users set their own passwords?

#333

Post by gcanyon » Sun, Jul 23, 2023, 3:51 AM UTC

tomsmeding wrote: post #117

gcanyon wrote: post #88

Earlier quoted context omitted.

> Take my father, there is no way he could use a password manager...He has a notebook of passwords Your father does use a password manager: a slow, very inconvenient one. If you could teach him to reach for ctrl-c/ctrl-v instead of a pencil, it would be easier for him.

It would be easier for you, who (I suspect) has, like most of us here on HN, a good understanding of what happens on a computer, how to control that, how to manage their software, how to be aware of what is on the foreground when and taking input when. How to recognise various applications and seeing the difference between materially different ones that try to look the same. Your notebook will look markedly different…

My point wasn't that an actual password manager would be easier. My point was that a text document on the computer would be as easy/easier to keep track of than a piece of paper.

It might reasonably be argued that it's less secure, since it's pretty hard to hack an air-gapped sheet of paper. But it's not harder to use.

Re: Why even let users set their own passwords?

#334

Post by gcanyon » Sun, Jul 23, 2023, 3:59 AM UTC

samwillis wrote: post #126

tomsmeding wrote: post #117

Earlier quoted context omitted.

It would be easier for you, who (I suspect) has, like most of us here on HN, a good understanding of what happens on a computer, how to control that, how to manage their software, how to be aware of what is on the foreground when and taking input when. How to recognise various applications and seeing the difference between materially different ones that try to look the same. Your notebook will look markedly different…

> I think GP's father doesn't have that awareness, and never will, by choice. This! I mention password managers, two factor or just try and get him to improve his passwords and his eyes glaze over and can see him beginning to nod off. Probably somewhat my fault for always bring them up after a meal when he's probably already half way to napping...

I wasn't trying to imply an actual password manager is as easy as a sheet of paper. I just meant that a simple text document would work as well, with find and replace, and the ability to easily make a copy of it for backup.

Re: Why even let users set their own passwords?

#335

Post by xp84 » Sun, Jul 23, 2023, 4:54 AM UTC

j1elo wrote: post #329

rjh29 wrote: post #323

Earlier quoted context omitted.

or the entitled "I've disabled Javascript, all web developers should make their site work without JS" when even in 2013 only 0.2% of all users to gov.uk had JS disabled* https://gds.blog.gov.uk/2013/10/21/how-many-people-are-missi...

That might be a very misleading statistic. What if more than 0.2% of people wanted to disable JavaScript, but in the end surrended to the fact that those pesky web devs never test their creations with JS disabled? I know I am one of those who would like to disable JS, but it's just not practical. So stats really are a dangerous tool, they sometimes can end up telling you just what you want to hear...

> people...who would like to disable JS, but it's just not practical

As I tell my kid when he "wants" something, I want a pony, and a million dollars.

I don't see why the fact that some people might like that matters. I mean, given the choice for free sure I'd "like" it too. But it will never remotely be worth it to build two entirely separate web applications for every website to make that dream a reality, nor do I see the whole Internet agreeing to discard the decades of advancements in FE technologies to go back to script-free HTML.

All that said, boy would that be a great jobs program for developers over age 35 though! Imagine developing for the web with no Webpack, no JS compilers, transpilers, bundles.[1]

[1]: Or whatever you frontend folks use for your toolchain this year, or this nanosecond...

Re: Why even let users set their own passwords?

#336

Post by ponorin » Sun, Jul 23, 2023, 5:14 AM UTC

lolinder wrote: post #19

> Often this will be combined with fallacious notions such as “remember this device”, the idea being you only have to go through all this the first time when logging in from a particular device. This idea is fallacious because the web has no notion of a “device”, and this is a very intentional design choice made for privacy purposes. We are literally living through the gradual phase-out of third-party cookies, amongs…

> The phasing out of third-party cookies has nothing to do with the "remember this device" functionality, because those are almost always powered by first-party cookies, which are not being phased out.

Cookies are cookies, not a "device". You could theoretically copy whatever cookies they put in to authenticate in other place and get automatically logged in.

> The author has configured their browser to throw away cookies when the last tab closes

If web was supposed to be stateful, this would be a bug, and the author would have had to dig through experimental or advanced settings to enable it. But because web(HTTP) is fundamentally stateless, it is a feature, and it's a feature that every browser exposes to normal user. Your browser is not expected to keep your cookies, just like your browser isn't expected to support javascript to access a website, or that you should enable them even if you could.

Re: Why even let users set their own passwords?

#337

Post by figassis » Sun, Jul 23, 2023, 5:42 AM UTC

lolinder wrote: post #291

starttoaster wrote: post #290

Earlier quoted context omitted.

It seems to me like the user you're replying to is well aware of how web devs attempt to identify unique devices (browser cookies.) They're saying that the manner that this is implemented leads to poor user experiences due to the faulty assumption that just because a cookie doesn't exist in the client browser, that the device is in fact unique to previously used devices. Which I don't see how your comment actually ad…

I'm the parent commenter, but the viewpoint you're agreeing with is an extract from the article, not my perspective, as indicated by the > before the paragraph. My own comments are the subsequent two paragraphs. In short, I entirely agree with @brasic: the article author has a nonstandard configuration (clearing cookies automatically before their expiry date) and based their entire article on the difficulties that th…

Maybe just accept my password and at most my TOTP? Asking for some others auth method that I may not be able to provide in a timely manner or at all only helps the provider cover their ass.

Re: Why even let users set their own passwords?

#338

Post by cobbaut » Sun, Jul 23, 2023, 6:15 AM UTC

DenisM wrote: post #230

samwillis wrote: post #173

Earlier quoted context omitted.

Something like 90% of burglaries are looking for car keys. That's why I keep my keys by the front door in eyesight on anyone who comes in. I have insurance, and don't want a thug wandering around my house.

Now there’s a thought. Clever. Does it make sense to also keep some decoy items, like an old MacBook in plain sight?

> Does it make sense to also keep some decoy items, like an old MacBook in plain sight?

I hope so. I always leave an old Macbook and iPhone in sight when leaving the house.

Re: Why even let users set their own passwords?

#339

Post by cobbaut » Sun, Jul 23, 2023, 6:21 AM UTC

gcanyon wrote: post #88

samwillis wrote: post #5

We probably will stop one day, but that day isn't yet for many services. There are people who would be unable to use those services if that can't set the password to either the same or a variant of one they always use. In the tech wold we often forget that there is a wide disparity in people's ability to use tech. Take my father, there is no way he could use a password manager, or two factor, it's just never going to…

> Take my father, there is no way he could use a password manager...He has a notebook of passwords Your father does use a password manager: a slow, very inconvenient one. If you could teach him to reach for ctrl-c/ctrl-v instead of a pencil, it would be easier for him.

>> Take my father, there is no way he could use a password manager...He has a notebook of passwords

>Your father does use a password manager: a slow, very inconvenient one

Writing down certain passwords can be very convenient. No hacker on the internet is going to access the piece of paper on my desk.

I consider myself computer savvy and I still write down some passwords on paper instead of having them stored on an internet connected computer. (I believe burglars really don't care about passwords. And it is very easy to obscure the written passwords.)

Re: Why even let users set their own passwords?

#340

Post by hinkley » Sun, Jul 23, 2023, 6:23 AM UTC

danShumway wrote: post #274

hinkley wrote: post #203

Earlier quoted context omitted.

Maybe shared local storage should be a browser standard. Let me keep track of my own data, but also share it with my tablet and phone by clicking a bunch of buttons.

This is circling around Native File Access, which is absolutely something the web needs and if handled correctly would be a huge improvement for user privacy and user autonomy. It would open the door for fully offline webapps with no accounts or serverside components, with much better sandboxing than native apps, and with full user control over app data using just a file browser. And it would allow for app data that…

Is that what I'm talking about though?

We are talking about tablet phone and laptop sharing a data store.

Not multiple user agents on the same device sharing a data store. Though we have entered the era where the names of specs or initiatives have little to nothing to do with the actual meat of the thing.