Re:Stop Trying to Fix the User (2016)
by snarfy on Wednesday October 18, 2017 @06:21AM
(#15498003)
But I have to fix the user.
I could let the user enter any password regardless of password rules, the only rule being it meets the minimum entropy requirements (long enough). Instead, I must make them enter a password that is a minimum of 8 characters with mix of case and symbols.
Why? Because it's the industry's best practice. To not follow would open the company to liability, so I do what the other monkeys are doing [1].
I could let the user enter any password regardless of password rules, the only rule being it meets the minimum entropy requirements (long enough). Instead, I must make them enter a password that is a minimum of 8 characters with mix of case and symbols.
Why? Because it's the industry's best practice. To not follow would open the company to liability, so I do what the other monkeys are doing [1].
[1] - https://security.stackexchange.com/q/33470