Hunt and Peck Security

Here's a novel idea: stop masking passwords on your login forms. You may think that is controversial and this will lead to the impending doom of the Internet. Not so much if you ask me.

For one, triggering a little paranoia and forcing users to look over their shoulders before typing in the passwords is a good thing. Any alert co-worker or coffee-shop-patron can pickup up the 5 letter name of a favorite pet as the keyboard is pecked. If users saw their simple password on the screen, they would be more inclined to pick a better one. Also, once these common world people start realizing that passwords are not the end-all to cyber security, they may start paying attention and switch to a single-sign on solution that can handle security better using thick-client technologies, or at least multi-factor authentication.

So how do you go about switching this paradigm? The first step is to provide the user with the option to mask the password with a little checkbox under your password input field. By default, you show the password in the clear but allow the user to check a box to mask it. Perhaps then we can start avoiding these types of articles from Wired.

Cup Cake McGyver

Amy was craving cup cakes tonight. Turns out Kara's in San Francisco closes at 9pm and a Meyer Memon Cupcake extravaganza was out of the question. Welcome to the city that always sleeps (did I mention we moved here from South Beach). Fortunately for my hungry wife, I found a centiliter measure and awoke my photographic memory of a recipe spotted on a gma's kitchen counter 3 decades ago. Turns out you can make a a wife happy out of raw material without the use of a box and instructions.

Except for the photographic memory, tonight's situation reminds me of the lack of common sense in today's computer use. You've all heard the horror stories, and no-one thinks it concerns themselves. Chances are if you made it this far into this rambling post, you already know that you *should* know better when it comes to your own online usage. Yet, still you store passwords in FireFox and reuse passwords so that any random forum you sign up for could engage in a very successful guessing game.

No sense in preaching to the choir, since you are not listening anyway. No, the question is what we as a community can do about it. Slowly by surely, I have disconnected myself from a local password storage and are using myOneLogin.com full-time as a replacement for my slowly aging and faulting memory.

Short of sending Chuck Norris with a bee-bee gun to your home, here's some reading to scare some sense into you:
SC Magazine