Skip to main content
32 events
when toggle format what by license comment
Oct 22, 2018 at 10:19 comment added O. R. Mapper "Allowing the user the option to login with another service (Google, Facebook, etc.) is a good option." - as long as it's an option and I can instead provide a user name/password combination (IMHO the much better way, not at last in terms of protecting my data), that's fine. Whenever I see a site that only allows login via another network's account, I'm gone.
Oct 19, 2018 at 13:37 comment added Ruadhan2300 Speaking from experience, web-services don't tolerate large data-packets very well unless they're expecting them. Yes 4.13MB counts as "large" for this purpose :P Sounds like an amusing way to kill the password manager
Oct 18, 2018 at 14:04 comment added user7886229 @Mołot Fair enough I am gonna do some testing and see if the resources wasted are significant.
Oct 18, 2018 at 14:02 comment added Mołot @JBis I only found calculation.
Oct 18, 2018 at 14:01 comment added user7886229 @Mołot Only at stack exchange would someone actually calculate that 😂😂😂. Thanks.
Oct 18, 2018 at 13:51 comment added Mołot @JBis "For what it's worth, once you remove their extra text, the Project Gutenberg plaintext (ASCII) copy of the King James Bible (Old and New Testaments) is 4.13MB in size" seems very doable in 30 sec. And there is no point of wasting resources to hash it.
Oct 17, 2018 at 0:44 comment added user7886229 @Mark if you want your password to be King James Bible and you can submit it within 30 sec. Be my guest :)
Oct 17, 2018 at 0:42 comment added user7886229 @Mark that's what max execution time is for....
Oct 17, 2018 at 0:41 comment added Mark @JBis, you need a maximum to keep someone from DoSing you by using the King James Bible as their password, but it should be higher than what any sensible person would use (I favor a limit of 1000 characters).
Oct 16, 2018 at 18:51 comment added user7886229 @IllusiveBrian ....or because we are hashing (RIGHT?!?!?!) there shouldn't be a max....
Oct 16, 2018 at 18:51 comment added IllusiveBrian @Ferrybig As long as we're talking about password managers, allow at least 32 characters maximum in the password (the length of the default 128-bit key in KeyPass). The larger the maximum the better.
S Oct 16, 2018 at 15:44 history suggested User42 CC BY-SA 4.0
corrected somme grammar/spelling
Oct 16, 2018 at 13:22 comment added Der Kommissar @JBis Oh I'll let you edit it in (I don't have much rep on this site anyway, so it has to sit in approval unless you or someone else approves it anyway, and since it changes the answer others are far less likely to approve). :) (And I just move away from Google CAPTCHA's now. I literally just find a different place to do/buy/whatever. Unless there's no competitor, it's not worth the hassle.)
Oct 16, 2018 at 13:20 comment added user7886229 @202_accepted Thanks! I'll definitely edit that in (unless you'd like to). Captchas used to be simple but they have turned in really complicated tasks that take longer to do than the form itself. P.S. a trick I have found, especially with google captchas, is to click the audio feature. It seems to allow me to get it more consistent.
Oct 16, 2018 at 13:20 review Suggested edits
S Oct 16, 2018 at 15:44
Oct 16, 2018 at 13:13 comment added Der Kommissar @JBis Great answer, only thing I'd add: don't use a CAPTCHA. They don't help matters anymore (they're actually getting easier for robots and harder for humans with each iteration), and just piss users off (and if the user is like me, they go find a competitor right out of the gate).
Oct 16, 2018 at 10:58 comment added user7886229 @Dubu Are you sure it was stolen and not given? See "don't share information". And thanks :)
Oct 16, 2018 at 10:57 comment added Dubu Good list, but one item is missing for me: User account data gets stolen. I could list about half a dozen websites/companies where I created an account to do a purchase or get some information and that account data was later stolen. (I use unique e-mail addresses so at least I see when those addresses get into the hands of spammers and can block them.) So, if you want any more information than just a volatile e-mail address and a password, I will think twice before creating an account.
Oct 15, 2018 at 21:34 comment added Draco18s no longer trusts SE Ph and make sure your password verification matches the rules shown to the user (and show them!) I had a website complain that my 8 character password wasn't a minimum of 8 characters once. Or just today one said that my "any three types" (upper, lower, number, symbol) password that contained upper, lower, and symbols wasn't valid (because it didn't have a number).
Oct 15, 2018 at 18:23 comment added user7886229 I love how this has turned into a rant against websites!
Oct 15, 2018 at 18:15 comment added jamesqf Re autofill: No, NO, NO! Unless it's something like automatically looking up the state from the ZIP code, few things are more annoying.
Oct 15, 2018 at 17:12 comment added user7886229 @TKK +1 It's the dumbest thing! Also when they say it's "Free to sign up" so you sign up and then you have to pay to actually use the service.
Oct 15, 2018 at 17:01 comment added StackOverthrow Another: Don't offer to let the user proceed as a guest and then force them to sign up at the end. An online retailer lost a sale to me the other day because of this.
Oct 15, 2018 at 16:59 comment added StackOverthrow @BjörnLarsson You shouldn't store passwords even if you're using them.
Oct 15, 2018 at 14:47 comment added Björn Larsson I would like to add: Don't use passwords. At all. Instead, perform the "reset password"-routine when the user wants to login and then log them out after say 14 days. This way the user don't need to remember a password and you don't need to store it and potentially lose it to bad people attacking your server.
Oct 15, 2018 at 14:13 comment added Ferrybig Add "don't block password managers" to the list
Oct 15, 2018 at 7:59 comment added chrylis -cautiouslyoptimistic- Site-managed autocomplete for anything besides physical-address lookup is likely to be a UX disaster. Properly specifying input type and autocomplete attributes is substantially friendlier.
Oct 15, 2018 at 4:35 comment added user7886229 @ESR Grrrr. Talking about that I was on a site where I was create a an e-card. Wrote my entire letter and designed it. Told me to sign up to send it, so I did. And it redirected me to home page. I had to recreate the entire card.
Oct 15, 2018 at 4:33 comment added ESR "Countless website do this stupid thing where you signup and then are forced to retype your email, username, password just to sign back in." or they don't redirect you to the page you were previously on before having logged in. This is UX 101.
Oct 15, 2018 at 4:31 comment added Michael Lai +1 Nice to see lots of new contributors for this question. Just wondering if you have any actual examples of successful strategies that incorporate one or more of the techniques that you have mentioned?
Oct 15, 2018 at 0:00 review First posts
Oct 15, 2018 at 7:10
Oct 14, 2018 at 23:57 history answered user7886229 CC BY-SA 4.0