I am a tad shocked by your reply, and this for several reasons. Let's not even talk about how you inferred Eliott's credentials, or lack thereof, based on his disagreeing with your approach.
You write about "lulling your users into a false sense of security." If that is true, then how do you explain that the 'show' button only appears when clicking a password? In the name of full disclosure, shouldn't you make that option immediately visible?
Furthermore, contrary to what was posted here, I believe that you encrypt passwords when storing them. On Windows, you would use the user's password as a "master password" in fact. So, kudos for that. But, wait, isn't this a case of using a master password to lull the user... etc? (because, you know, things such as Ophcrak do not exist?)
I am not going to re-iterate what was already written about the cable guy being able to lift your password in 10 seconds, it's simply a scenario you cannot dismiss and it seems strange to me as I would expect you guys to do some persona-based design rather than deal in hypotheticals (cf. "trivially recoverable")
So, yes, Chrome is an excellent product. And yes, from an absolute standpoint, you make valid points. I simply do not believe that you are the only one here doing so, and if you are willing to post comment on HN, then hopefully you are also ready to acknowledge that things are not as clearcut as you make them to be.
Comments
I am a tad shocked by your reply, and this for several reasons. Let's not even talk about how you inferred Eliott's credentials, or lack thereof, based on his disagreeing with your approach.
You write about "lulling your users into a false sense of security." If that is true, then how do you explain that the 'show' button only appears when clicking a password? In the name of full disclosure, shouldn't you make that option immediately visible?
Furthermore, contrary to what was posted here, I believe that you encrypt passwords when storing them. On Windows, you would use the user's password as a "master password" in fact. So, kudos for that. But, wait, isn't this a case of using a master password to lull the user... etc? (because, you know, things such as Ophcrak do not exist?)
I am not going to re-iterate what was already written about the cable guy being able to lift your password in 10 seconds, it's simply a scenario you cannot dismiss and it seems strange to me as I would expect you guys to do some persona-based design rather than deal in hypotheticals (cf. "trivially recoverable")
So, yes, Chrome is an excellent product. And yes, from an absolute standpoint, you make valid points. I simply do not believe that you are the only one here doing so, and if you are willing to post comment on HN, then hopefully you are also ready to acknowledge that things are not as clearcut as you make them to be.