Why even let users set their own passwords?
I&#x27;ve said it before and I&#x27;ll say it again (and yes let it rain downvotes):<p>I don&#x27;t understand this whole discussion and maligning of passwords.<p>You cannot save all people. Some fixed %-age of people will always become victims - either by choosing a terrible password or by being shot in the foot by some terribly complex 5FA device-based passphrase scheme that attempts to protect them but ends up betraying the user once they replace their phone or it breaks or for any other mundane reason.<p>User picked passwords (1FA) are and will always be the single best solution that has ever existed for authentication, considering everything from security to usability and practicality, wholistically.<p>If I sign up for some crappy service that I&#x27;ll barely even remember a week later I should be good to go setting my password to &quot;asdf&quot; and that&#x27;s everything I need to log in.<p>Fuck everything else.
<a href="https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=36717356">https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=36717356</a>