Earlier quoted context omitted.
Wait. Why is zero restrictions on passwords a bad thing?
there should be a minimum length. Or people will use 2-4 character passwords (often the initials of their name etc)
This is their problem then.
Let them paste passwords
351–360 of 376 posts
Re: Let them paste passwords
#352Of course it reduces security. It makes you resort to either 1.) typing it out manually while you can't see if you made a mistake 2.) using developer tools to set the 'value' attribute directly "SPP" discourages use of a password manager. End of story. I also see this pattern used on banking websites for inputs like an account number. This drives me crazy as well for the same reason. The computer can get it right mor…
So many forms also ask to enter the email address twice. I mean I can understand asking to type in the password twice, but email address - seriously!?
That restriction I can understand, though I think passwords should not have to be typed twice. If you enter the password incorrectly, you can always reset it after the fact. But if you enter the incorrect email address (and subsequently forget the password), it will be harder to access your account since you presumably do not have access to the (erroneous) email used for registration.
Re: Let them paste passwords
#353Earlier quoted context omitted.
Incidentally, what are these APIs? I am building a rich content app (SVG editor) and have been starting to think about what copy + paste will look like.
I think you want to investigate the "ClipboardEvent" web API. Try starting here: https://developer.mozilla.org/en-US/docs/Web/API/ClipboardEv...
Thanks!
Re: Let them paste passwords
#354Earlier quoted context omitted.
One (probably forgotten) reason people validated email addresses with convoluted regexps is that there are multiple (actually valid per RFC) email addresses formats that can do nasty things. Like explicitly specifying a series of mail servers to go through. They're (hopefully) deprecated and rejected by most servers nowadays, though.
> hopefully Why?
> By default, this feature is turned off. This closes a nasty open relay loophole where a backup MX host can be tricked into forwarding junk mail to a primary MX host which then spams it out to the world.
http://www.postfix.org/postconf.5.html#allow_untrusted_routi...
Re: Let them paste passwords
#355Earlier quoted context omitted.
One photograph can contain several virtual knickknacks. I usually don't use sticky notes, as I also make a mnemonic to relate the character to the story. For instance, a story about the beach could use '@' as a conch shell, or '*' as a sea star, or '$' as a sand dollar, or '~' for ocean waves. But everyone has their own tricks for remembering things. And I certainly don't make the effort for sites that I don't consid…
It's amazing the lengths people will go to to justify not using a password manager. Use a password manager. KeepassX is free, cross-platform, works on phones, does all that work for you, secures even your least-valuable accounts, does things right, doesn't store your passwords "in the cloud" and you'll get to keep applying your scheme to your master password.
Exercising your memory is good for more than just passwords, you know.
Re: Let them paste passwords
#356Earlier quoted context omitted.
It's amazing the lengths people will go to to justify not using a password manager. Use a password manager. KeepassX is free, cross-platform, works on phones, does all that work for you, secures even your least-valuable accounts, does things right, doesn't store your passwords "in the cloud" and you'll get to keep applying your scheme to your master password.
Exercising your memory is good for more than just passwords, you know.
Like I said. Amazing.
Re: Let them paste passwords
#357Earlier quoted context omitted.
Yup. The most email validation I evern implement is "there must be an @ sign with stuff before and after the @ sign". Maybe require a dot in the latter space.
I know lots of developers (myself included) who thought they could write a functional email regex. Eventually you learn that in the end, the way to validate an email address is to send an email.
> Eventually you learn that in the end, the way to validate an email address is to send an email.
In my experience as a user, most people in the end also validate the email address by sending an email, but do no learning.
Re: Let them paste passwords
#358Earlier quoted context omitted.
Strictly speaking, the dot in the latter space isn't actually necessary. It needs to be a resolvable domain, but if you bought a TLD you could be "name@tld"
I don't think an @domain is required if it's an email address on the same mail server.
That certainly used to work on Gmail; I haven't tried recently.
(Obvious caveat being that any provider can trivially append @provid.er if you don't specify, so this isn't really proof that email is specified that way.)
Re: Let them paste passwords
#359Earlier quoted context omitted.
...is there someone out there who did this?
Not that I'm aware of. Although I wouldn't be surprised if google did it for their employees. They already own the google TLD, they could very easily make it point to the google.com emails.
How many HN-reading googlers have you just made to send 'Test' emails to themselves, I wonder!
Re: Let them paste passwords
#360Earlier quoted context omitted.
That reduces password entropy and makes the hashes easier to crack.
Well, does it? Even if you crack it you don't have the correct casing. So you don't have the original password. Of course doesn't help if every other website converts to lower case too. But if you use bcrypt you can partially compensate by using a higher work factor.
> Well, does it? Even if you crack it you don't have the correct casing.
The 'correct casing' is any member of the set of all permutations of cases. So you both do, don't, and do not care.