Passwords, as in user chosen secrets used to prove identity, are a really bad idea in general.
Turns out, people are crappy at coming up with stuff that is hard to guess. They are also crappy at remembering things that are hard to guess.
That’s why every website these days wants to SMS you a code or makes you use an Authenticator.
Thankfully people are catching on, and secure passwordless sign in is gaining ground rapidly.
I’m surprised no place uses IP addresses anymore to authenticate (I was around when Postopia did or whatever that candy themed game place was). Many IP-ban when it comes to identifying rulebreakers, you’d think they’d IP-authenticate too.
Passwords, as in user chosen secrets used to prove identity, are a really bad idea in general. Turns out, people are crappy at coming up with stuff that is hard to guess. They are also crappy at remembering things that are hard to guess. That’s why every website these days wants to SMS you a code or makes you use an Authenticator.
Thankfully people are catching on, and secure passwordless sign in is gaining ground rapidly.
I’m surprised no place uses IP addresses anymore to authenticate (I was around when Postopia did or whatever that candy themed game place was). Many IP-ban when it comes to identifying rulebreakers, you’d think they’d IP-authenticate too.
Imagine if your roommate could just get into all your accounts?
I know that’s untactical, but I mean as long as IP bans are already a thing…
All major services do risk based authentication these days. I’m fairly certain network address factors into the risk calculations.
Carrier grade NAT. For instance, on our local mobile phone network, thousands of handsets will have the same public IP address.