Security is always traded off against convenience. That's not an excuse, it's just the nature of the beast.

It's amazing how many people don't understand this. I like to tell people I can give them a 100% secure firewall. Then I tell them it's called an AirGap - do you still want it? Engineers understand that everything is a tradeoff.

Everybody knows this, it's a matter of whether it's worth it or not; where you draw the line.

POF users did indeed get the convenience of a password reminder in every email. But they also got the inconvenience of having their passwords compromised, the consequences of which could both be catastrophic and go unnoticed for a long time. In summary, not a great user experience at all; thus "user experience" is a bad excuse, especially in this particular case.

Actually not. I started using 1Password and I must say it increased both, security and convenience. No temptation to reuse the same (and simple) password, easy login ("Fill and login") and password generator with which I generated absurdly complex passwords I am using now. And I don't even have to remember them!

That would be a single point of failure for your entire online life, it would seem. I've actually got no idea how one would assess where that sat on the trade-off spectrum.

What would you consider a failure? I use 1Password + Dropbox, so in effect my passwords database is backed on three computers and iPhone. That's one additional benefit: new logins and passwords are synced.

I would consider someone else gaining access to the contents of your 1Password database a failure.

> Don't try to excuse bad security practice with "user experience"

Thank you for saying this. It's distressing how many people are rushing to his defense, by saying, basically, "well he's successful and rich, what do you know?"

I know that I'd be pretty pissed if my passwords where being stored in plain text and got leaked all over the internet - and most of the people using this non-excuse would be to.

There are plenty of ways to provide the same service of mailing out passwords that PoF has without leaving plain text passwords laying all over the place. Since the founder is supposed to be such a screaming genius when it comes to programming and running servers, I'm surprised he didn't know any of them....

To be cynical about it, you have to do a cost-benefit analysis. Is the improved user experience of being able to remind people of their passwords so much better that it brings in more revenue than what you can potentially lose from the risk of being hacked?

As I said above, this is even a false dilemma. You can have both increased security and increased usability by including one-time hashes in URLs that log users in.

Yes, that's the right way to do it, but a URL that makes the user auto-login is not the same thing as actually reminding the users of their passwords. And I bet that quite a lot of people prefer getting their password in a mail instead of a weird URL thing and being forced to enter a new password.

Remember that you and me are not the main target group of a service like this.