Hacker News Reader

The worst password tip is using a password-protected system in the first place.

Passwords are neither theoretically or practically reliable. They off-load security to the user, who is the weakest part of all the scheme obviously. Who is obviously uncapable of remembering by heart dozens of long passwords of random gibberish.

We should know better than use passwords.

View on HN

What should we use instead?

Something based on public key cryptography. Private keys contained in some kind of protected device where they can't be easily stolen from. Or, even better, distributed.

Are you going to protect your private key with a password? Or are you recommending we use password-less private keys?

Also, please let me know when you've convinced the major banks and web service providers to use public key cryptography instead of passwords.

I'm going to store my private key in an arrangement you can't read it from even if you control the system.

For stupid services we can generate long random passwords, store them along. Not bothering the user with that.

Reply on news.ycombinator.com