-17

I get the following message when trying to provide a password I'll actually remember:

"Must contain at least 1 more unique character."

Let's talk about security in the context of computers, because a lot of times security nuts overlook something crucial: what is it that you are securing?

As a demonstration in meetings with such people, I've placed a penny on a conference room table and asked,

"How much money, time and effort should I spend securing this penny?"

This gets the conversation going in the right direction -- people start asking what we're securing, what are the ramifications of a breach, etc. People stop screaming, We need to tighten security with no particular reason.

A stackoverflow account relates far more closely to the penny than something of serious value. If somebody breaks into my Stack Overflow account, I'm out no money and the offending party gets to read questions I've posted and post new questions.

This isn't a high-threat situation, it's a low-threat situation.

Those who feel they need to protect their points will inherently pick something stronger, while people like me can pick things they'll remember knowing that Stack Overflow isn't Ft. Knox.

8
  • 4
    I think you've misunderstood the discussion tag. Commented Aug 10, 2015 at 17:17
  • 9
    SE uses openid. While they also provide their own openid implementation that you can use, you're also free to use any other provider out there, including a provider that has more or less stringent security, based on your personal preferences.
    – Servy
    Commented Aug 10, 2015 at 17:19
  • Can you clarify what you are asking and/or want to be discussed? I think it is about the security policies currently implemented by the SE team who you seem to disqualify with regard to keeping things safe.
    – rene
    Commented Aug 10, 2015 at 17:29
  • 2
    You can use the SE OpenID provider to authenticate against many other sites that accept OpenID. SE chose rather high requirements for the password because they treat it as a generic OpenID provider and not simply as the password to Stack Exchange itself. Commented Aug 10, 2015 at 17:51
  • @rene I believe he wants lower security on the password. The "restrictions" put in by Stack are too much for him to create an easily rememberable password, so he wants them "dropped" for him to be able to get a password he can remember. His point it "if it's only to a Stack account, why do I need more than "password" as a password? I won't lose anything if someone hacks my Stack account"
    – Patrice
    Commented Aug 10, 2015 at 18:09
  • @Patrice - I think the issue is that this appears to be a feature request but it's tagged as a discussion.
    – BSMP
    Commented Aug 10, 2015 at 18:11
  • @BSMP oh.... fair point. I don't pay enough attention to tags in meta :P
    – Patrice
    Commented Aug 10, 2015 at 18:11
  • From what I can tell without actually creating a new account, SE doesn't put any restrictions on which symbols you can have in your password. This makes creating a memorable password easier than on sites that don't allow certain symbols.
    – BSMP
    Commented Aug 10, 2015 at 18:14

1 Answer 1

17

You are only looking at the side of what the account means to you, not what it means to the owners of the site and the community.

If your account is compromised, you are not the only victim.

And besides, password vaults that generate passwords are free and easy to use and since you are a security expert, you surely use one, right?

2
  • Ok, so lets look at it from the perspective of the site owners: if my account is compromised, they lock the account and maybe delete a few spam posts. But from the perspective of the attacker, the ease in creating account is far less than in compromising my account, so IMO we're back to my penny analogy. Commented Aug 10, 2015 at 20:46
  • That assumes that reputation does not exist when it does. It should also be added that if SO membership is worth so little to you, then by all means, don't invest any effort into it.
    – GEOCHET
    Commented Aug 10, 2015 at 21:39

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .