Re:Can you trust 37signals with your password?
by ryanwaggoner on Saturday May 02, 2009 @12:18PM
(#589968)
Do you have any evidence of this? They said two years ago that they were going to change it...what makes you think it's not just a case of them being lazy?
Re:Can you trust 37signals with your password?
by Hexstream on Saturday May 02, 2009 @12:31PM
(#589986)
It is true that 37signals emphasizes making the lives of their customers easier. To a fault.
But I don't see how the password recovery feature would be any less easy and convenient if it consisted of sending an email with a password reset link that brings you to a page where you just enter a new password twice and get logged in immediately. You have to deal with password reset link expiry and such but no big deal.
Re:Can you trust 37signals with your password?
by sgk284 on Saturday May 02, 2009 @01:27PM
(#590037)
A lot of people don't like changing passwords.
You don't have to change it. Type in the same password if you really want.
Of course, if you knew what the password was in the first place, you wouldn't have needed to reset your password...
Re:Can you trust 37signals with your password?
by thaumaturgy on Saturday May 02, 2009 @05:11PM
(#590214)
I can come at this from the other end: part of my consulting deals with end-users on a daily basis, and I've seen even novice users _finally_ starting to use multiple passwords on their own without prompting.
So, it more likely would be a simple case of their forgetting which password they used on that particular system.
I don't love this design decision --- ok, no, wait, I hate this design decision --- but don't make it out to be something it isn't. The 37s team knows how to do "secure" password storage (that's every other Rails plugin ever written). They chose this because they thought it would make their customers lives easier.