121–130 of 376 posts
On "change your password" screens, you don't want the second "confirm password" field to be pastle-able to stop this scenario.
1) User tries to type "mypassword" but enters "mypasswor" instead.
2) User copy-pastes "mypasswor" into "confirm password field"
3) User hits "submit".
Now when the user tries to login with "mypassword" it fails.
On "change your password" screens, you don't want the second "confirm password" field to be pastle-able to stop this scenario.
1) User tries to type "mypassword" but enters "mypasswor" instead.
2) User copy-pastes "mypasswor" into "confirm password field"
3) User hits "submit".
Now when the user tries to login with "mypassword" it fails.
Earlier quoted context omitted.
>if you can remember your password, its probably too weak As XKCD famously pointed out[0], Diceware[1]-style pass phrases can be both secure and memorable. XKCD's four word example isn't secure when fast brute-force attacks are feasible, but eight words is still easily memorable and secure enough for anything. The important point here is that "random words" really does mean "random", i.e. not picked by a human. [0] h…
I thought password cracking machines now guess words as well as characters? Like they will guess all 8 character passwords and will also guess all 6 word passwords using common words like they guess characters? Therefore using just a few common words stuck together with nothing else is no longer secure? (This is a genuine question because I could be totally wrong on that, I can't even remember where I heard it)
"Justification 2: 'Pasting passwords makes them easier to forget, because you have fewer chances to practise them'." if you can remember your password, its probably too weak
So by definition your password manager master key is weak? That's an interesting paradox!
hunter2 is the password manager I wrote for this: https://chiselapp.com/user/rkeene/repository/hunter2/
Earlier quoted context omitted.
Not allowing + in an email field is one of my pet peeves. Congrats on finding an amazing-looking regex for email validation instead of thinking about it.
Yup. The most email validation I evern implement is "there must be an @ sign with stuff before and after the @ sign". Maybe require a dot in the latter space.
Of course it reduces security. It makes you resort to either 1.) typing it out manually while you can't see if you made a mistake 2.) using developer tools to set the 'value' attribute directly "SPP" discourages use of a password manager. End of story. I also see this pattern used on banking websites for inputs like an account number. This drives me crazy as well for the same reason. The computer can get it right mor…
>> 1.) typing it out manually while you can't see if you made a mistake This is my pet peeve. Password fields should not be obfuscated by default. It should be a toggle that is off on page load. Shoulder surfing is a corner case.
Of course it reduces security. It makes you resort to either 1.) typing it out manually while you can't see if you made a mistake 2.) using developer tools to set the 'value' attribute directly "SPP" discourages use of a password manager. End of story. I also see this pattern used on banking websites for inputs like an account number. This drives me crazy as well for the same reason. The computer can get it right mor…
It's interesting that a lot of us are assuming that pasting encourages the use of password managers. However; I worry that this is a very BIG assumption. Even in my IT-literate circles password management usage is low. In my non-IT circles it is non-existent, and not because of SPP particularly; I suspect SPP (which I agree is silly) derived from an understanding that allowing an average person to paste passwords mea…
Of course it reduces security. It makes you resort to either 1.) typing it out manually while you can't see if you made a mistake 2.) using developer tools to set the 'value' attribute directly "SPP" discourages use of a password manager. End of story. I also see this pattern used on banking websites for inputs like an account number. This drives me crazy as well for the same reason. The computer can get it right mor…
Other signs that a site was built by incompetent developers (Or had too much management interference--Devs aren't always to blame!): Only works with Internet Explorer Doesn't work with Internet Explorer Password must have one of 4-10 special characters, but not other special characters. (e.g.: Must contain !, @, ^, &, or parentheses, but not ;, ", etc) Passwords have no requirements Right-click is disabled Video play…
Of course it reduces security. It makes you resort to either 1.) typing it out manually while you can't see if you made a mistake 2.) using developer tools to set the 'value' attribute directly "SPP" discourages use of a password manager. End of story. I also see this pattern used on banking websites for inputs like an account number. This drives me crazy as well for the same reason. The computer can get it right mor…
It's interesting that a lot of us are assuming that pasting encourages the use of password managers. However; I worry that this is a very BIG assumption. Even in my IT-literate circles password management usage is low. In my non-IT circles it is non-existent, and not because of SPP particularly; I suspect SPP (which I agree is silly) derived from an understanding that allowing an average person to paste passwords mea…
Of course it reduces security. It makes you resort to either 1.) typing it out manually while you can't see if you made a mistake 2.) using developer tools to set the 'value' attribute directly "SPP" discourages use of a password manager. End of story. I also see this pattern used on banking websites for inputs like an account number. This drives me crazy as well for the same reason. The computer can get it right mor…
It's interesting that a lot of us are assuming that pasting encourages the use of password managers. However; I worry that this is a very BIG assumption. Even in my IT-literate circles password management usage is low. In my non-IT circles it is non-existent, and not because of SPP particularly; I suspect SPP (which I agree is silly) derived from an understanding that allowing an average person to paste passwords mea…