[drivebyacct2]

I cry everytime I read these threads on HN. I've never seen such stubborness than people desperately convinced that they need to be able to memorize their passwords, or that password managers are the devil.

I'll say it again, just use a password manager. It generates random, complex passwords. It memorizes them for you. It pre-populates forms. They are locally encrypted and can be synced by themselves or with other tools. They can even be protected with two factor auth.

My mother uses LastPass. So can you.

[diego]

See all my other comments on this thread. Why does your mother use LastPass? How did she learn about it? How about the other 99% of the people? How do you make them use LastPass?

This is not about us.

[res0nat0r]

> Tell the user: your password must contain the following word: “hzru”

Enforcing this kind of thing on the masses won't make for stronger passwords, it will just have them opening up notepad.exe and saving this sites too-hard-to-remember-because-it-has-too-many-rules password on ~/Desktop/logins.txt

[diego]

Now you'd have to prove that having passwords stored in a file is worse than massive password leaks. I suspect that it isn't. People already carry laptops with browsers that save passwords automatically. Losing your laptop already implies a password-change-fest.

[thedufer]

Are you implying that browsers save passwords in cleartext? A quick search indicates that all major browsers encrypt passwords to user accounts, and some give the option of a master password as well.

[Devilboy]

They do encrypt passwords but that doesn't matter. You can still log in to their accounts and do anything you want. And if for some reason you really do want the actual passwords you can obtain those too, obviously they get decrypted to send to the website you're logging in to so just capture it at that point. Normal people don't configure master passwords.

[gus_massa]

And when they go to another computer (home/work/relatives/...) the only option is to carry that file.

[Zikes]

One could forgo this password policy and advertise LastPass in the sign-up form for which this article's hypothetical readership is responsible.

[drivebyacct2]

Ok, I'll put it another way. I'm some extremely large number percent more likely to be an early adopter of your product than my mother. I will never, ever sign up with such a restriction on my password.

I don't care what we do about the rest of them. Make a bigger black list, require more complex passwords, implement better protections against brute force.

The easiest one (to use and implement) is two-factor auth, but many people lack smartphones still so it's hard to make that the easy call.

[Devilboy]

If you want to MAKE people use secure passwords you assign them a random password and don't allow them to choose their own. They'll write it down on a piece of paper making them pretty damn secure against almost anything except a physical break-in.