# The Dirty Truth About Web Passwords

**URL:** <https://discourse.codinghorror.com/t/the-dirty-truth-about-web-passwords/99>\
**Category:** blog\
**Created:** [December 14, 2010, 12:00am UTC](https://discourse.codinghorror.com/t/the-dirty-truth-about-web-passwords/99 "2010-12-14T00:00:00Z")\
**Posts on this page:** 7\
**Page:** 4

<div class="post-metadata">

**Author:** ![Sarat](https://discourse-cdn.codinghorror.com/letter_avatar_proxy/v2/letter/s/dbc845/32.png) [@Sarat](https://discourse.codinghorror.com/u/Sarat)\
**Post date:** [December 29, 2010, 12:00am UTC](https://discourse.codinghorror.com/t/the-dirty-truth-about-web-passwords/99/64 "2010-12-29T00:00:00Z")

</div>

Excellent post Jeff. There are site like [digg.com](http://digg.com) also stores user password. Gawker isa perfect example for them to learn!

---

<div class="post-metadata">

**Author:** ![Thinkwitty](https://discourse-cdn.codinghorror.com/letter_avatar_proxy/v2/letter/t/e19b73/32.png) [@Thinkwitty](https://discourse.codinghorror.com/u/Thinkwitty)\
**Post date:** [December 29, 2010, 12:00am UTC](https://discourse.codinghorror.com/t/the-dirty-truth-about-web-passwords/99/65 "2010-12-29T00:00:00Z")

</div>

Great article.  
I like the “internet driving license”.  
I need to change some passwords.

And I logged here with twitter 🙂

---

<div class="post-metadata">

**Author:** ![Throwaway](https://discourse-cdn.codinghorror.com/letter_avatar_proxy/v2/letter/t/f475e1/32.png) [@Throwaway](https://discourse.codinghorror.com/u/Throwaway)\
**Post date:** [January 5, 2011, 12:00am UTC](https://discourse.codinghorror.com/t/the-dirty-truth-about-web-passwords/99/66 "2011-01-05T00:00:00Z")

</div>

I hate OpenID and I think its a crazy idea to centralize all your security and identity with one provider. OpenID is like a passport, and sites like stackoverflow and this blog are like walmarts and dollarstores. I shouldn’t have to show my ultimate passport ID for the most trivial transactions (buying a bag of chips, for eg).

Jeff, listen to the people, don’t be arrogant and please offer local passwords. You sound like google when they didn’t want to add a Delete button to gmail because they thought they knew better than their users. Some people just aren’t interested in maintaining a consistent, proper and centralized on-line identity, especially not with sites they use very very occasionally (like stackoverflow, for eg).

Posted via the openid host at [http://openid.aliz.es/](http://openid.aliz.es/) - whoever made that is my hero of the day.

---

<div class="post-metadata">

**Author:** ![Lerolero](https://discourse-cdn.codinghorror.com/letter_avatar_proxy/v2/letter/l/f07891/32.png) [@Lerolero](https://discourse.codinghorror.com/u/Lerolero)\
**Post date:** [January 25, 2011, 12:00am UTC](https://discourse.codinghorror.com/t/the-dirty-truth-about-web-passwords/99/68 "2011-01-25T00:00:00Z")

</div>

Great [openid.aliz.es](http://openid.aliz.es), really proved who I am to make a post.

We also could throw the internet away and design a new one, and everybody could switch to it in fews days, what do you think?

---

<div class="post-metadata">

**Author:** ![Iamfake](https://discourse-cdn.codinghorror.com/letter_avatar_proxy/v2/letter/i/c4cdca/32.png) [@Iamfake](https://discourse.codinghorror.com/u/Iamfake)\
**Post date:** [January 25, 2011, 12:00am UTC](https://discourse.codinghorror.com/t/the-dirty-truth-about-web-passwords/99/69 "2011-01-25T00:00:00Z")

</div>

How about don’t use password at all? Just pick an ID and use this as your OpenID,

[http://opennoid.appspot.com/id](http://opennoid.appspot.com/id)

---

<div class="post-metadata">

**Author:** ![Acmesquares](https://discourse-cdn.codinghorror.com/letter_avatar_proxy/v2/letter/a/a8b319/32.png) [@Acmesquares](https://discourse.codinghorror.com/u/Acmesquares)\
**Post date:** [March 4, 2011, 12:00am UTC](https://discourse.codinghorror.com/t/the-dirty-truth-about-web-passwords/99/70 "2011-03-04T00:00:00Z")

</div>

Owch. Double wammy of Facebook asking for real names, (and people went for that), and then using the facebook ID to log into everywhere on the internet. Privacy nightmare.

---

<div class="post-metadata">

**Author:** ![WilliamC](https://discourse-cdn.codinghorror.com/letter_avatar_proxy/v2/letter/w/ce7236/32.png) [@WilliamC](https://discourse.codinghorror.com/u/WilliamC)\
**Post date:** [December 14, 2011, 12:00am UTC](https://discourse.codinghorror.com/t/the-dirty-truth-about-web-passwords/99/73 "2011-12-14T00:00:00Z")

</div>

Just came across a Microsoft ‘create account’ form which fails validation when a password is supplied longer than 16 characters.

Good grief!

[Previous page](https://discourse.codinghorror.com/t/the-dirty-truth-about-web-passwords/99.md?page=3)