Post

This blew my mind: cphpost.dk/2026-10-10/n... Not sure who needs to know this, but 123456 is not a secure password.

I once worked on a large system with millions of users, an oversight meant that clear text passwords were being output in the log files. Astonishing how many were `123456` or `password` or `hello`, or any number of other easily guessable alternatives.

And so many accounts are low-consequence. What's the issue if someone hacks my Goodreads account for example? If there's a "login with Google" option, just use that. It's the best advice IMHO.

Yeah! I don't have numbers, but social login is a good thing to delegate control to. Ofc there are risks, but few will lose their google creds. Magic links and/or forgot password is a good option too. Changes authentication from "a fiddly string to remember/store" to "go to my inbox"