Passwords Evolved: Authentication Guidance for the Modern Era
This is a nice article. Only thing missing is calling out "secret questions" as asinine.<p>I loathe when sites require you to set them up as it requires manually generating a series of N-length random strings (ex: eZDWzazuMw0ZzD4nKhxXXVN3) and saving the pair (question plus random text) as metadata associated with the account. Not exactly pulling teeth but it's pretty annoying to manually do that for 3-5 entries.<p>Even worse offenders are the sites that don't even let you enter a value in a text box but instead require you to pick from a drop down with a handful, say 10-15, of entries (<i>cough</i> United Airlines <i>cough</i>).<p>And the very worst offenders are the ones that, after successfully authenticating with your password, ask you for the answers to the secret questions every single time you log in (<i>cough</i> again United Airlines <i>cough</i>).