• 0 Posts
  • 7 Comments
Joined 3 years ago
cake
Cake day: July 9th, 2023

help-circle
  • You know that, I know that, XKCD knows that and that’s a great way to do it BUT- it’s not just four random words. It’s four random words per service/website I use, which starts to complicate things again.

    Sure I can use a password manager on mobile, but Granny who wants to talk to Little Johnny on the messenger he recommended doesn’t have one, nor will she typically remember the four (slightly modified) words in 6 weeks time, meaning she will probably write it down on paper to remember, inherently more insecure than allowing her a shorter password, possibly with a special character she might be able to remember, in my opinion.

    I understand the security requirements and why they make sense, but we’re in the field of messengers here, which are incredibly hard to get people to switch to at the best of times. If people are immediately hit with a hurdle at registration, it will probably scare quite a lot of them away if they’re already out of my comfort zone and I find that a shame for such a neat looking project.





  • That’s a shame. It was my reason for uninstalling. I don’t have a password manager on mobile so there is no chance of me remembering such a long password, so it would lead me to either writing it down on paper, or worse, sending it to myself via a messenger so I don’t need to type it in all the time, which I feel in all cases is less secure than having a shorter but more complicated password (maybe about 8 characters).

    I’m assuming other users may share my opinion, especially for a genre of app like a messenger, for which it is generally hard to convince people to install as they don’t want to leave their closed WhatsApp playpen.

    Maybe a solution which caters for both worlds could be considered: recommend 16 but accept and warn if someone types in a shorter one (with a minimum of 8)?