Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

Radical idea: Don't let users choose their passwords. Let them instead generate access keys.


I think that's the best approach.

My router had a random pre-generated password. It was a series of consonant vowel consonant atoms separated by numbers. That manages to be reasonably memorable and highly secure, and it's reasonably unlikely to land on something someone finds offensive.


The problem is enabling the user to keep track of the key. These two solutions spring to mind:

* Password managers

* Physical objects that hold the key (credit cards, access cards)

Or, for a non-solution:

* Just get angry at anyone who forgets their password, while also insisting they never write it down (a common approach in the bad old days)


In my first job, the ancient VMS system for timesheets required you to select a password out of a list. You could refresh it as many times as you wanted, but you had to type one of the passwords provided by the system.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: