It's alarming to me just how many supposedly "secure" websites follow such awful practices, such as:
- Using HTTPS only for the login or purchase page, and sending the user to plain-old HTTP for everything else
- And to make the above even worse, storing passwords in plain text in a cookie
- Disallowing certain characters in passwords, or forcing passwords to be under a certain length
- Allowing people to reset passwords from the browser with just one answer to a security question, i.e. not even sending a confirmation email
- Not supporting any form of two-factor authentication
The question I keep asking myself lately is, is there a better method to authentication than just plain ole' passwords? There are other systems that we're starting to see now being used more often in consumer devices, such as RFID and fingerprint/face scanners, but those have some obvious weaknesses as well.
Let's not get started on those who implement that poorly.
I was signing up for a site that took openid the other day- and then after confirming access - I was returned to the site. There, I was prompted for email, first/last name, and 2x password to use on the site, in order to complete my registration. (This email and password would be my future login.)
Nothing quite like implementing a buzzword while missing the point completely...
Comments
It's alarming to me just how many supposedly "secure" websites follow such awful practices, such as:
- Using HTTPS only for the login or purchase page, and sending the user to plain-old HTTP for everything else
- And to make the above even worse, storing passwords in plain text in a cookie
- Disallowing certain characters in passwords, or forcing passwords to be under a certain length
- Allowing people to reset passwords from the browser with just one answer to a security question, i.e. not even sending a confirmation email
- Not supporting any form of two-factor authentication
The question I keep asking myself lately is, is there a better method to authentication than just plain ole' passwords? There are other systems that we're starting to see now being used more often in consumer devices, such as RFID and fingerprint/face scanners, but those have some obvious weaknesses as well.
OpenID?
Let's not get started on those who implement that poorly.
I was signing up for a site that took openid the other day- and then after confirming access - I was returned to the site. There, I was prompted for email, first/last name, and 2x password to use on the site, in order to complete my registration. (This email and password would be my future login.)
Nothing quite like implementing a buzzword while missing the point completely...
OpenID is not quite good enough.
Persona on the other hand is what you want, long term. Mozilla did everything right.
That is, everything except marketing it properly. And abandoning it... sigh.