{"id":856,"date":"2010-05-12T08:15:44","date_gmt":"2010-05-12T15:15:44","guid":{"rendered":"https:\/\/simpleprogrammer.com\/?p=856"},"modified":"2016-07-20T01:46:46","modified_gmt":"2016-07-20T05:46:46","slug":"dont-make-me-make-a-password","status":"publish","type":"post","link":"https:\/\/simpleprogrammer.com\/dont-make-me-make-a-password\/","title":{"rendered":"Don&#8217;t Make Me Make a Password"},"content":{"rendered":"<p>I can&#8217;t be trusted. \u00a0Neither can you.<\/p>\n<p>If you have me make a password, I&#8217;ll do one of these things:<\/p>\n<ul>\n<li>Use the same password on other sites because I don&#8217;t want to try and remember them all<\/li>\n<li>Make a fake email address and password just for your site because I don&#8217;t trust you<\/li>\n<li>Make a new password for your site and forget it, then cause you to have to support resetting it for me<\/li>\n<li>Just not sign up at all, it&#8217;s not worth the emotional baggage<\/li>\n<\/ul>\n<p>And if you decide to have me sign up with a new password, you&#8217;ll have to do these things:<\/p>\n<ul>\n<li>Make sure that you hash and salt the password in your database<\/li>\n<li>Make sure that you give me a secure connection to send my password over the wire when I first log-in<\/li>\n<li>Secure access to your web server, since it will be having my password in memory<\/li>\n<li>Create a secondary method of authentication, since I could forget my password<\/li>\n<li>All kinds of other stuff an expert on web security would know that I wouldn&#8217;t<\/li>\n<\/ul>\n<p><strong>I&#8217;ve become more aware of this problem, as my iTunes account was compromised somehow and someone charged some $50 gift certificates to it.<\/strong><\/p>\n<p>Of course I had to go change all my passwords for any accounts that shared that password, and that is a big hassle. \u00a0Yes, I know I shouldn&#8217;t be using the same password for multiple sites, but it is so annoying trying to keep track of multiple passwords.<\/p>\n<p>I am using <a href=\"https:\/\/lastpass.com\/\">LastPass<\/a> now, we&#8217;ll see how that works out.<\/p>\n<p><a href=\"https:\/\/simpleprogrammer.com\/wp-content\/uploads\/2010\/05\/stealing.jpg\"><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-858\" title=\"stealing\" src=\"https:\/\/simpleprogrammer.com\/wp-content\/uploads\/2010\/05\/stealing.jpg\" alt=\"\" width=\"460\" height=\"347\" srcset=\"https:\/\/simpleprogrammer.com\/wp-content\/uploads\/2010\/05\/stealing.jpg 460w, https:\/\/simpleprogrammer.com\/wp-content\/uploads\/2010\/05\/stealing-300x226.jpg 300w\" sizes=\"auto, (max-width: 460px) 100vw, 460px\" \/><\/a><\/p>\n<h2>Just don&#8217;t do it<\/h2>\n<p>So rather than making people resort to a service like LastPass, just do the right thing. \u00a0Let someone else handle the authentication for you.<\/p>\n<p>There are plenty of solutions out there.<\/p>\n<ul>\n<li><a href=\"http:\/\/openid.net\/\">OpenID<\/a><\/li>\n<li><a href=\"http:\/\/msdn.microsoft.com\/en-us\/library\/aa480189.aspx\">Cardspace<\/a><\/li>\n<li><a href=\"http:\/\/developers.facebook.com\/docs\/guides\/web\">Facebook Connect<\/a><\/li>\n<\/ul>\n<p>Personally, I don&#8217;t care which one you use. \u00a0Most people are going to have an account on all three. \u00a0 I like to imagine that someday the world would be a perfect place where there is only one place you log in, but until that day,\u00a0don&#8217;t pollute the space more!<\/p>\n<p>If you really feel that you need to create a login system for your application, consider this:<\/p>\n<h2>Users like easy<\/h2>\n<p><strong>More people will sign up for your site if they don&#8217;t have to sign up for your site.<\/strong> I can&#8217;t count the number of sites\u00a0where I got halfway through the sign-up process and closed the web page, because I just didn&#8217;t feel like it was worth the effort.<\/p>\n<p>On the other hand, there are many sites that had OpenID for a sign in or sign in with Facebook, and I quickly joined, because it was almost no effort.<\/p>\n<p>Consider how easy it is to sign up for <a href=\"http:\/\/stackoverflow.com\">StackOverFlow.com<\/a>, and how easy it is to log back in. \u00a0Often I will google some search result and get to the site not intending to log in, but then I remember how easy it is and I just click the Google OpenID button and I am logged in. \u00a0Just like that. \u00a0I like easy mode for web sites.<\/p>\n<h2>Best security is to delegate<\/h2>\n<p>As a developer I have a motto: &#8220;I suck at security.&#8221; \u00a0Unless you are an expert in security, (probably even if you are), you should have that motto too. \u00a0It doesn&#8217;t mean not to learn about security. \u00a0It doesn&#8217;t mean to not enforce security as best you know how. \u00a0It just means realize that whatever you think you know, you still suck, and it won&#8217;t be good enough.<\/p>\n<p>If you take that mindset you are much less likely to be over-confident and think that your mad cryptographic I-once-took-a-class-on-cryptography skills will be sufficient. \u00a0<strong>If you take the mindset of &#8220;sucking&#8221; at security, you are going to want to delegate security to someone and somewhere else.<\/strong><\/p>\n<p>The best way to be secure is to give the responsibility over to someone whose job it is and knows it inside out. \u00a0Don&#8217;t want to close credit card numbers? \u00a0Good&#8230; don&#8217;t store them. \u00a0Don&#8217;t want to risk your users passwords? \u00a0Good, don&#8217;t store those either.<\/p>\n<h2>Vacation<\/h2>\n<p>Off topic here. \u00a0I am taking a short vacation (no relation to iTune incident), so there won&#8217;t be blog posts on my usual schedule for a bit.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>I can&#8217;t be trusted. \u00a0Neither can you. If you have me make a password, I&#8217;ll do one of these things: Use the same password on other sites because I don&#8217;t want to try and remember them all Make a fake email address and password just for your site because I don&#8217;t trust you Make a&#8230;<\/p>\n","protected":false},"author":2,"featured_media":858,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_kad_post_transparent":"","_kad_post_title":"","_kad_post_layout":"","_kad_post_sidebar_id":"","_kad_post_content_style":"","_kad_post_vertical_padding":"","_kad_post_feature":"","_kad_post_feature_position":"","_kad_post_header":false,"_kad_post_footer":false,"_kad_post_classname":"","footnotes":""},"categories":[2185,801],"tags":[],"class_list":["post-856","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-best-practices","category-security"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v27.6 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>Don&#039;t Make Me Make a Password<\/title>\n<meta name=\"description\" content=\"An explanation of why it&#039;s better to delegate website security to a third party and how requiring a password may prevent users from signing up on your site.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/simpleprogrammer.com\/dont-make-me-make-a-password\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Don&#039;t Make Me Make a Password\" \/>\n<meta property=\"og:description\" content=\"An explanation of why it&#039;s better to delegate website security to a third party and how requiring a password may prevent users from signing up on your site.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/simpleprogrammer.com\/dont-make-me-make-a-password\/\" \/>\n<meta property=\"og:site_name\" content=\"Simple Programmer\" \/>\n<meta property=\"article:published_time\" content=\"2010-05-12T15:15:44+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2016-07-20T05:46:46+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/simpleprogrammer.com\/wp-content\/uploads\/2010\/05\/stealing.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"460\" \/>\n\t<meta property=\"og:image:height\" content=\"347\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"John Sonmez\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"John Sonmez\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"4 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/simpleprogrammer.com\\\/dont-make-me-make-a-password\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/simpleprogrammer.com\\\/dont-make-me-make-a-password\\\/\"},\"author\":{\"name\":\"John Sonmez\",\"@id\":\"https:\\\/\\\/simpleprogrammer.com\\\/#\\\/schema\\\/person\\\/1abc70edfb189184827740310672de67\"},\"headline\":\"Don&#8217;t Make Me Make a Password\",\"datePublished\":\"2010-05-12T15:15:44+00:00\",\"dateModified\":\"2016-07-20T05:46:46+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/simpleprogrammer.com\\\/dont-make-me-make-a-password\\\/\"},\"wordCount\":740,\"commentCount\":3,\"image\":{\"@id\":\"https:\\\/\\\/simpleprogrammer.com\\\/dont-make-me-make-a-password\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/simpleprogrammer.com\\\/wp-content\\\/uploads\\\/2010\\\/05\\\/stealing.jpg\",\"articleSection\":[\"Best Practices\",\"Security\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\\\/\\\/simpleprogrammer.com\\\/dont-make-me-make-a-password\\\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/simpleprogrammer.com\\\/dont-make-me-make-a-password\\\/\",\"url\":\"https:\\\/\\\/simpleprogrammer.com\\\/dont-make-me-make-a-password\\\/\",\"name\":\"Don't Make Me Make a Password\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/simpleprogrammer.com\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/simpleprogrammer.com\\\/dont-make-me-make-a-password\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/simpleprogrammer.com\\\/dont-make-me-make-a-password\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/simpleprogrammer.com\\\/wp-content\\\/uploads\\\/2010\\\/05\\\/stealing.jpg\",\"datePublished\":\"2010-05-12T15:15:44+00:00\",\"dateModified\":\"2016-07-20T05:46:46+00:00\",\"author\":{\"@id\":\"https:\\\/\\\/simpleprogrammer.com\\\/#\\\/schema\\\/person\\\/1abc70edfb189184827740310672de67\"},\"description\":\"An explanation of why it's better to delegate website security to a third party and how requiring a password may prevent users from signing up on your site.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/simpleprogrammer.com\\\/dont-make-me-make-a-password\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/simpleprogrammer.com\\\/dont-make-me-make-a-password\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/simpleprogrammer.com\\\/dont-make-me-make-a-password\\\/#primaryimage\",\"url\":\"https:\\\/\\\/simpleprogrammer.com\\\/wp-content\\\/uploads\\\/2010\\\/05\\\/stealing.jpg\",\"contentUrl\":\"https:\\\/\\\/simpleprogrammer.com\\\/wp-content\\\/uploads\\\/2010\\\/05\\\/stealing.jpg\",\"width\":460,\"height\":347},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/simpleprogrammer.com\\\/dont-make-me-make-a-password\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/simpleprogrammer.com\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Don&#8217;t Make Me Make a Password\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/simpleprogrammer.com\\\/#website\",\"url\":\"https:\\\/\\\/simpleprogrammer.com\\\/\",\"name\":\"Simple Programmer\",\"description\":\"\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/simpleprogrammer.com\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/simpleprogrammer.com\\\/#\\\/schema\\\/person\\\/1abc70edfb189184827740310672de67\",\"name\":\"John Sonmez\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/dc2f18dfa76e017566ce607de002d7abe4acfd5ec19a6db82c180b00867b8d94?s=96&d=mm&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/dc2f18dfa76e017566ce607de002d7abe4acfd5ec19a6db82c180b00867b8d94?s=96&d=mm&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/dc2f18dfa76e017566ce607de002d7abe4acfd5ec19a6db82c180b00867b8d94?s=96&d=mm&r=g\",\"caption\":\"John Sonmez\"},\"url\":\"https:\\\/\\\/simpleprogrammer.com\\\/author\\\/jsonmez\\\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Don't Make Me Make a Password","description":"An explanation of why it's better to delegate website security to a third party and how requiring a password may prevent users from signing up on your site.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/simpleprogrammer.com\/dont-make-me-make-a-password\/","og_locale":"en_US","og_type":"article","og_title":"Don't Make Me Make a Password","og_description":"An explanation of why it's better to delegate website security to a third party and how requiring a password may prevent users from signing up on your site.","og_url":"https:\/\/simpleprogrammer.com\/dont-make-me-make-a-password\/","og_site_name":"Simple Programmer","article_published_time":"2010-05-12T15:15:44+00:00","article_modified_time":"2016-07-20T05:46:46+00:00","og_image":[{"width":460,"height":347,"url":"https:\/\/simpleprogrammer.com\/wp-content\/uploads\/2010\/05\/stealing.jpg","type":"image\/jpeg"}],"author":"John Sonmez","twitter_card":"summary_large_image","twitter_misc":{"Written by":"John Sonmez","Est. reading time":"4 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/simpleprogrammer.com\/dont-make-me-make-a-password\/#article","isPartOf":{"@id":"https:\/\/simpleprogrammer.com\/dont-make-me-make-a-password\/"},"author":{"name":"John Sonmez","@id":"https:\/\/simpleprogrammer.com\/#\/schema\/person\/1abc70edfb189184827740310672de67"},"headline":"Don&#8217;t Make Me Make a Password","datePublished":"2010-05-12T15:15:44+00:00","dateModified":"2016-07-20T05:46:46+00:00","mainEntityOfPage":{"@id":"https:\/\/simpleprogrammer.com\/dont-make-me-make-a-password\/"},"wordCount":740,"commentCount":3,"image":{"@id":"https:\/\/simpleprogrammer.com\/dont-make-me-make-a-password\/#primaryimage"},"thumbnailUrl":"https:\/\/simpleprogrammer.com\/wp-content\/uploads\/2010\/05\/stealing.jpg","articleSection":["Best Practices","Security"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/simpleprogrammer.com\/dont-make-me-make-a-password\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/simpleprogrammer.com\/dont-make-me-make-a-password\/","url":"https:\/\/simpleprogrammer.com\/dont-make-me-make-a-password\/","name":"Don't Make Me Make a Password","isPartOf":{"@id":"https:\/\/simpleprogrammer.com\/#website"},"primaryImageOfPage":{"@id":"https:\/\/simpleprogrammer.com\/dont-make-me-make-a-password\/#primaryimage"},"image":{"@id":"https:\/\/simpleprogrammer.com\/dont-make-me-make-a-password\/#primaryimage"},"thumbnailUrl":"https:\/\/simpleprogrammer.com\/wp-content\/uploads\/2010\/05\/stealing.jpg","datePublished":"2010-05-12T15:15:44+00:00","dateModified":"2016-07-20T05:46:46+00:00","author":{"@id":"https:\/\/simpleprogrammer.com\/#\/schema\/person\/1abc70edfb189184827740310672de67"},"description":"An explanation of why it's better to delegate website security to a third party and how requiring a password may prevent users from signing up on your site.","breadcrumb":{"@id":"https:\/\/simpleprogrammer.com\/dont-make-me-make-a-password\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/simpleprogrammer.com\/dont-make-me-make-a-password\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/simpleprogrammer.com\/dont-make-me-make-a-password\/#primaryimage","url":"https:\/\/simpleprogrammer.com\/wp-content\/uploads\/2010\/05\/stealing.jpg","contentUrl":"https:\/\/simpleprogrammer.com\/wp-content\/uploads\/2010\/05\/stealing.jpg","width":460,"height":347},{"@type":"BreadcrumbList","@id":"https:\/\/simpleprogrammer.com\/dont-make-me-make-a-password\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/simpleprogrammer.com\/"},{"@type":"ListItem","position":2,"name":"Don&#8217;t Make Me Make a Password"}]},{"@type":"WebSite","@id":"https:\/\/simpleprogrammer.com\/#website","url":"https:\/\/simpleprogrammer.com\/","name":"Simple Programmer","description":"","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/simpleprogrammer.com\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/simpleprogrammer.com\/#\/schema\/person\/1abc70edfb189184827740310672de67","name":"John Sonmez","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/dc2f18dfa76e017566ce607de002d7abe4acfd5ec19a6db82c180b00867b8d94?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/dc2f18dfa76e017566ce607de002d7abe4acfd5ec19a6db82c180b00867b8d94?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/dc2f18dfa76e017566ce607de002d7abe4acfd5ec19a6db82c180b00867b8d94?s=96&d=mm&r=g","caption":"John Sonmez"},"url":"https:\/\/simpleprogrammer.com\/author\/jsonmez\/"}]}},"_links":{"self":[{"href":"https:\/\/simpleprogrammer.com\/wp-json\/wp\/v2\/posts\/856","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/simpleprogrammer.com\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/simpleprogrammer.com\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/simpleprogrammer.com\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/simpleprogrammer.com\/wp-json\/wp\/v2\/comments?post=856"}],"version-history":[{"count":0,"href":"https:\/\/simpleprogrammer.com\/wp-json\/wp\/v2\/posts\/856\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/simpleprogrammer.com\/wp-json\/wp\/v2\/media\/858"}],"wp:attachment":[{"href":"https:\/\/simpleprogrammer.com\/wp-json\/wp\/v2\/media?parent=856"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/simpleprogrammer.com\/wp-json\/wp\/v2\/categories?post=856"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/simpleprogrammer.com\/wp-json\/wp\/v2\/tags?post=856"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}