Grand River Transit

[ijmorlan]

So, think of the average user, the average user doesn't even know what a password manager is, let alone how to use one.  But also, this entirely defeats the purpose of the security questions, the purpose being that in the event you lose your password (for example, if your password manager database is lost), you are able to securely identify yourself another way by knowing this information about yourself independently from your password.

Not that it's a great system anyway, these questions are both guessable and also hard to remember.  Security questions should be a relic of the past.

Leading many to use a single password for all purposes.  Terrible practice, but what can they do?

There is a huge and fundamental difference between a single password which is revealed to numerous entities, and storing multiple secure passwords in a single password store that are all unlocked by the same secure password. Note too that the password store password is never sent over the network at all.

My bugaboo is the inability to set a randomly determined password consisting of, say, 8 lowercase letters. Note the “randomly determined”. 8 random lowercase letters give way more password choices than the usual “my dog’s name with a capital letter, digit, and punctuation appended” sort of password choice mechanism, and are way easier to type.

Also some sites don’t even allow Safari’s randomly-chosen password, which consist of several blocks of upper- and lower-case letters and digits, combined with dashes.

So the correct way for a password system to work is to allow Safari’s (or your favourite browser) password store to auto-generate its passwords. If a higher level of security is truly needed, issue two-factor tokens. If it’s too expensive to do so, then the higher level of security is not obtainable, full stop. OK, not full stop, I continue to say that it probably isn’t actually needed. Any situation where the higher level is needed probably has enough resources floating around that two-factor is feasible.

A site can also allow Facebook/Google/… logins. That is especially appropriate for relatively low-security situations like a transit agency fare account login. This avoids all the issues associated with storing and updating passwords — essentially you outsource an entire section of the application, and avoid cluttering people’s lives with yet more rarely-used passwords.