11–20 of 34 posts
Earlier quoted context omitted.
Agreed on the password manager. I've got 1Password in Safari, and the "Generate Password" option is so easily available it becomes second nature.
Sounds like that would make it much harder to switch browsers...
Consider the rampant use of twitter clients. Should you stop using them? Stop trying new ones?
No.
"since they don’t yet offer OAuth" OAuth wouldn't solve the problem though, it'd just move it somewhere else. Use a different login for each site - use a password manager.
Earlier quoted context omitted.
That's a good point. OAuth would at least centralize the problem towards a more trusted source and limit the number of places the credentials would be stored. I trust Google or Facebook to have more safeguards in place than a webapp that popped up yesterday. As for password managers, I totally agree people should use them, but as a practical matter, most non-tech people do not.
You trust Google to control all your logins ;) I have a cautionary tale to tell about that one...
As for your cautionary tale, I'm pretty familiar with the players here, axod. Why don't you tell us?
Continue to share your twitter credentials with sites you trust, but stop once they implement OAuth. Consider the rampant use of twitter clients. Should you stop using them? Stop trying new ones? No.
Moreover, each app that asks for passwords for another service adds social proof that this is how we build applications. It isn't.
So all someone has to do is create a Twitter-app that collects username and password for 10,000 users and randomly starts paying themselves. What could go wrong?
Earlier quoted context omitted.
You trust Google to control all your logins ;) I have a cautionary tale to tell about that one...
For a huge percentage of all Internet users, a Google or Yahoo compromise is game-over; they're going to lose their bank account, and then their social, and their identity (if they lose the lottery). So centralizing on Google or Yahoo is a sensible plan. As for your cautionary tale, I'm pretty familiar with the players here, axod. Why don't you tell us?
Probably for the average person though as you say, centralizing control is probably easiest until something like that happens to them.
Wouldn't an idea be to centralize this with your ISP? The ISP already knows who you are, seems like they would be a good authority on handling authentication to websites for you. (OK, doesn't work for when you're using some hotel wifi etc)
Continue to share your twitter credentials with sites you trust, but stop once they implement OAuth. Consider the rampant use of twitter clients. Should you stop using them? Stop trying new ones? No.
You're sidestepping the point of the article. Ivan Kirigin is not going to get screwed over by a website that asks for his Twitter password. But my mom might, because it is extremely likely that one of these fly-by-night Twitter add-on apps will lose their database to some stupid SQLI bug. My mom almost certainly uses the same password for Twitter and Yahoo Mail. Moreover, each app that asks for passwords for another…
I agree 100% that asking for passwords is a very bad practice, and users shouldn't be trained to do it. They should fix it immediately.
I suppose people could stick to twitter.com and sms - but to me, the defacto twitter world has clients. They are important. I want people to use them. Give your password to sites you trust, Mom.