43M passwords hacked in Last.fm breach
Regular reminder that new users in general don&#x27;t care at all about the security of your site.<p>Most of your signups are not going to generate and store a secure password &quot;just to try you out&quot;, as evidenced by the most common password here &quot;123456&quot;. If you force people to signup to try your site&#x2F;app, many (most?) of them are going to use a crap password. If you&#x27;re _lucky_ that&#x27;ll be 123456, and not their email&#x2F;facebook&#x2F;internet-banking password.<p>The answer isn&#x27;t to try and force &quot;good passwords&quot; from users who don&#x27;t care. Remember, by definition - they don&#x27;t care.<p>We need to start trying to not require users to come up with passwords until they do care. Maybe just cookie me and let me tromp around as an unauthenticated user until I do something that needs me to set up a password-protected account. Maybe ask for my email and send me a login link that hooks me into my account&#x2F;data without me setting a password (lets face it, your password security is going to fundamentally rely on the security of my email account, &#x27;cause your &quot;forgot password&quot; story says you&#x27;ll happily send a password rest link there, right?<p>I know Start-up-de-jour desperately needs &quot;signed up user numbers&quot; for their investor pitch, but that&#x27;s  not going to motivate me to stop using 123456 or password123 as a password when startupdejour.io demands I create an account just to look around.