Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

There's an interesting general argument you're making here and I'm not prepared to immediately reject it, but one detail I will push back on hard is "use low complexity passwords for unimportant accounts".

This is inadvisable. While the accounts direct utility may not be high, and it increases user overhead, a malicious party can accumulate access to tens of a user's "low value" accounts to farm metadata or incidentally relevant data.

Additionally, the end user is not always the best judge of which accounts are even high value. My aunt insists, for example, that her Amazon account does not need a complex password because she "only" buys cookware from it. A silly example, but it illustrates the point.



I'd generally say anything you save payment info in for general physical purchases should probably be secured decently. But consider: Social media accounts used for public posting present no additional metadata. The risk profile to many accounts being stolen is "they can see my already public content, and also pretend to be me on that site". Which is of limited value. I'd really hope nobody trusted a sensitive transaction solely based on my HN posts, for instance. (It's definitely fair though that many people are not a good judge of this particular risk assessment.)

And I'd say for many sites, using a one-time password that you immediately don't bother to save is also probably a reasonable step up from this. If it remembers you on all your computers for a while... just lose the credentials and reset it later.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: