New subject: [Wikitech-l] Password security

30 Jan 2006

brion vibber (brion @ pobox.com) wrote:
...
  I've disabled the ability to use blank passwords
on wiki accounts.

 For a long time we treated accounts very laxly in this regard; there generally
 wasn't _that_ much reason to secure a casual account unless you were one of the
 tiny number of sysops.

 In recent years though the number of sysops has exploded, and we've added
 customization features like the user javascript which are cool but potentially
 really annoying if someone gets into your account and messes with them. As a
 small concession to security and accountability, it's time for blank passwords
 to go.

 While running some password security checks, I found that a handful of sysop
 accounts had blank passwords. Probably some non-sysop accounts also had blanks.

 Affected accounts can reset the password by the automated e-mail
 password gadget on the login form, unless of course they didn't put in an e-mail.

This is seriously wrong. It should be completely reversed.

A lot of people have just lost their account because of this,
and it wasn't even announced that it was coming.
This part of the problem could be reduced if the change was
announced in advance.

However, that's not the full problem.
Many people use blank or trival passwords and don't give their emails.
This is completely reasonable, as it's very hard to remember just
another password (and reusing passwords on different websites is about
as bad as having none),
and even if spamming wasn't a problem, why the heck would any website
need their email in the first place ?

So, while dictionary-checking sysops' passwords make a lot of sense,
there's very little point in limiting passwords of the non-privileged accounts.

(and yeah, /me just lost 2 (rarely used) accounts on fr.wp and de.wp)

Re: [Wikitech-l] Password security