21–30 of 38 posts
Typical users don't have a concept of security, they only want convenience.
No, it's time to kill passwords. If I need to log in, send me two links and/or temporary auth codes: a persistent login clearly labeled, and a transient login for use in public places. If you're a serious site (banks, utilities, etc), use two-factor auth, don't accept anything less and of course, don't persist my login. Alternatively, I keep hoping to see user-controlled federated ID gaining traction - you know, a pe…
> dear people who make marketing email systems, please stop requiring me to log in when I follow your unsubscribe link. Isn't this illegal according to the CAN SPAM act, at least for the types of emails it covers? http://www.business.ftc.gov/documents/bus61-can-spam-act-com...
Yes, it is. The Can-Spam Act requires a simple opt-out procedure. Therefore requiring people to sign up in order to opt out is a violation of the law. Also, if you sign up, you become a customer, and as a customer, the company acquires the right to spam you till the sun goes down (the Can-Spam Act doesn't apply to customers).
No, it's time to kill passwords. If I need to log in, send me two links and/or temporary auth codes: a persistent login clearly labeled, and a transient login for use in public places. If you're a serious site (banks, utilities, etc), use two-factor auth, don't accept anything less and of course, don't persist my login. Alternatively, I keep hoping to see user-controlled federated ID gaining traction - you know, a pe…
Being that you support wild-abandon ubiquitous centralized digital identity, I'm guessing you use Gmail, in which case you can easily make a filter for the spam rather than going through the trouble of unsubscribing.
Filtering this stuff as spam is a workaround, though, not a solution.
No, it's time to kill passwords. If I need to log in, send me two links and/or temporary auth codes: a persistent login clearly labeled, and a transient login for use in public places. If you're a serious site (banks, utilities, etc), use two-factor auth, don't accept anything less and of course, don't persist my login. Alternatively, I keep hoping to see user-controlled federated ID gaining traction - you know, a pe…
Mozilla's Persona seems like an option. You can self-host and it seems to do what you want.
(I say this after having only skimmed it - could be wrong.)
No, it's time to kill passwords. If I need to log in, send me two links and/or temporary auth codes: a persistent login clearly labeled, and a transient login for use in public places. If you're a serious site (banks, utilities, etc), use two-factor auth, don't accept anything less and of course, don't persist my login. Alternatively, I keep hoping to see user-controlled federated ID gaining traction - you know, a pe…
> dear people who make marketing email systems, please stop requiring me to log in when I follow your unsubscribe link. Isn't this illegal according to the CAN SPAM act, at least for the types of emails it covers? http://www.business.ftc.gov/documents/bus61-can-spam-act-com...
But a year later when they suddenly decide to actually do that marketing, it's annoying because I no longer even know what that account is for - never mind how to log in.
Many places are making it truly one-click, but there are a fair number that still require you to authenticate before you can change 'account settings' like notification preferences.
Erm... TL;DR: Because of the existing relationship, I"m not sure that CAN SPAM applies.
No, it's time to kill passwords. If I need to log in, send me two links and/or temporary auth codes: a persistent login clearly labeled, and a transient login for use in public places. If you're a serious site (banks, utilities, etc), use two-factor auth, don't accept anything less and of course, don't persist my login. Alternatively, I keep hoping to see user-controlled federated ID gaining traction - you know, a pe…
>No, it's time to kill passwords. >don't persist my login You say no, but it reads yes.
Q: "Have you stopped beating your wife?" A: "No. It's time to discuss the appropriateness of wife beating."
Hmm...
Earlier quoted context omitted.
I'm forgetful. If I forget to log out, my account is open to everyone. If I forget to click "remember me", I have to sign in twice. Making systems that fail safely in case of human error is a good thing. Although one of my favorite ideas was a system I saw at a hardware store. You could use their terminals to look up products. The terminals had a pressure pad in front of them, and as soon as you stepped off the pad,…
Out of curiosity, what store (assuming its a chain, or large enough to be known outside local circles)? That's pretty nifty.
I miss living within driving distance of one :/
Earlier quoted context omitted.
> dear people who make marketing email systems, please stop requiring me to log in when I follow your unsubscribe link. Isn't this illegal according to the CAN SPAM act, at least for the types of emails it covers? http://www.business.ftc.gov/documents/bus61-can-spam-act-com...
I'm not sure - in the cases I'm considering, I did initiate a relationship with them however long ago when I registered [for whatever reason], and they are giving me the option to opt out. It's a safe bet that buried somewhere in the ToS I've given them the right to contact me for marketing by registering. But a year later when they suddenly decide to actually do that marketing, it's annoying because I no longer even…
Are people really unable to imagine alternatives to a "yes/no" debate? Certain websites should never have Remember Me checkboxes and should log you out when you close the tab, like banking websites (mine does have a Remember Me checkbox, for shame). There should be a convenience cost for security, or else you're probably not doing security right. Unless it's Reddit or something, there should be no Remember Me and the…
If you could easily identify that a site you were on had cookies stored, and that one was about you being logged in, and it was plain simple to wipe that cookie then I'm sure you'd be happier about that situation. Couple that with a default to have them disabled - until you explicitly lend your browser a little more trust - to prevent ticking those boxes in a public place. And we might all feel a little better about them.
I guess cookies though are a solution to the leave me logged in checkbox. Another technology could be used. I personally hate them as they currently are.
Even key chain programs are difficult to understand. Safari uses user key-chain, Firefox uses it's own profile to store passwords. No consistency and headaches for users.