This “blame the users for reusing passwords” thread is dangerous. It sets us back many years. We need robust solutions from verifiers ala NIST 800-63 and not unrealistic expectations that consumer-centric users will change their behaviors.
If someone creates a weak password and then reuses it across multiple services, do they have any responsibility if one of their accounts is then compromised via credential stuffing?
9
7
2
51
Yes, sites should require strong passwords, then try said password on the Alexa 1000 to ensure it is unique.
Nov 8, 2018 · 4:09 PM UTC
1