Post

Mike Hadlow
@mikehadlow.com

I once worked on a large system with millions of users, an oversight meant that clear text passwords were being output in the log files. Astonishing how many were `123456` or `password` or `hello`, or any number of other easily guessable alternatives.

0 reposts0 likes

Dan Moore
@mooreds.com

Doesn't surprise me at all, unfortunately. I imagine the rise of in-browser password managers has helped, but most folks want to get right through the login screen and do their jobs. Understandably.

Mike Hadlow
@mikehadlow.com

And so many accounts are low-consequence. What's the issue if someone hacks my Goodreads account for example? If there's a "login with Google" option, just use that. It's the best advice IMHO.

Dan Moore
@mooreds.com

Yeah! I don't have numbers, but social login is a good thing to delegate control to. Ofc there are risks, but few will lose their google creds. Magic links and/or forgot password is a good option too. Changes authentication from "a fiddly string to remember/store" to "go to my inbox"