Hacker News new | ask | show | jobs
by throwaway78678 1192 days ago
Probably. The worst for me are still the "test your password strength" websites though. So painful to explain to end users why it's NOT a good idea to use this.
1 comments

The good ones calculate pw Strength client-side, so there is nothing to worry about there. Problem, most people don’t know what the good ones are nor how to find them.

Bit warden has a good pw entropy checker.

If you trust them it technically (legally, things can be different) doesn’t matter much (they need to use https, and there’s the risk of them being hacked) whether it’s done client-side.

If you don’t trust them you’d have to check that they work 100% client-side every time you use such a site, and people don’t know how to do that.

That’s were tools you host yourself (on a server or by locally installing them) make a difference: you have to vet them only when you install or update them, not at every use.

Also, you can restrict the capability to install or update to qualified personnel who should do a better job at security evaluation than your regular employee working under a tight deadline.

> most people don’t know what the good ones are nor how to find them.

I've spent a few years working in the information security space, and I'm quite certain that I wouldn't know which ones are "the good ones" and which ones aren't.