Hacker News new | past | comments | ask | show | jobs | submit login

Let me decide whether I care if someone gains access to my account on some rinky dink web app.

Complexity requirements aren't targeted for you. You're making a conscious decision about what risks you're willing to assume. Most people aren't aware of the risks, even if told their password is weak. That is who complexity requirements target. (But the requirements probably aren't altruistic: they're really there to help protect the application and its developers from the perception of insecurity.)

This is one reason why application developers should get out of the business of building authentication systems. At least then the problems belong to someone else who we'll trust to have dealt with them.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: