Re:Show HN: Password validity hinting
by peterwwillis on Saturday March 10, 2012 @06:42PM
(#3689079)
Your experiment is attempting to produce a complicated method for a server to tell a user that they might not have typoed their password. This is probably not an issue because:
1. There is (to my knowledge) no reason to hide the password field with asterisks unless you have someone looking over your shoulder. If you really want to check for typos, use an 'unhide password field' icon/buttom like Android has.
2. Passwords are dead. I wouldn't even worry about somebody abusing this method because the user's password is probably "password1". Implement a second factor and you don't have to worry as much about a typo for a 20 character password.
3. Password managers never make typos.
4. Humans are fallible, typos happen, make it secure enough to handle typos or we're all doomed.
1. There is (to my knowledge) no reason to hide the password field with asterisks unless you have someone looking over your shoulder. If you really want to check for typos, use an 'unhide password field' icon/buttom like Android has.
2. Passwords are dead. I wouldn't even worry about somebody abusing this method because the user's password is probably "password1". Implement a second factor and you don't have to worry as much about a typo for a 20 character password.
3. Password managers never make typos.
4. Humans are fallible, typos happen, make it secure enough to handle typos or we're all doomed.