Thread

1. continuational · 1786022679 · focus · HN ↗

   It's kinda funny there is still software coming out whose security model is "constantly ask the user for permission, and hope they never make a mistake".

   It's been tried so many times before, and it never worked.

   1. brunoborges · 1786027372 · focus · HN ↗

      I joined Oracle in 2012, and I myself complained that the user experience was horrible: get an Oracle DB installed was a nightmare, starting with so many questions. I heard complaints from other users about it requiring, during installation, that an admin password must be set.

      I myself had preferred to use MySQL because it was so simple and easy to get started and using it.

      Until I learned how many MySQL databases were configured without user/password and many instances were reachable over the internet.

      Then, eventually products started to move towards "don't even ask the user to set a password, otherwise they will set a stupid password" and just generate the password during installation. This made the user think more before saving that password or changing the password to something less stupid. But better than all that, liability was no longer with the software maker.

      1. OroPla · 1786039565 · focus · HN ↗

         Maybe that is why so many things live in Excel instead of a proper database. Security at the expense of convenience does come at the expense of security, after all.

         Not sure why passwords still exist conceptually. I was hoping we'd move past this annoyance, but instead security has become even more annoying. And all that security with two factor hoops to jump through only for someone to steal your session cookie.

         1. pixl97 · 1786042872 · focus · HN ↗

            What would passwords move past too? A device people lose? Some specifications everyone argues about and implements differently. Just look at SAML and everyone using slightly different terminology.

            Security is more annoying because the attacks are better than ever.

Unofficial Hacker News client; not affiliated with Y Combinator.