Listen up, website folks

[yendi]

If your site's important enough to require a password, it's important enough to use a fucking secure server. As the default, too.

Culprits this morning include Boardgamegeek, Moodle.org, Tor.com, Librarything, Twitter, and LJ itself.

Comments

[yendi]

*nod* I'm very aware of some of those costs, as we have a bunch of servers at work that require them. And I see all your points about security.

But what really bothers me is that the proliferation of password-required sites in turn means more folks simply use the same password on ten different sites. And if some of those are the same on low-security "fun" sites as on important sites, it sets up bad things.

Yes, it's an example of user error, but it's also one that happens reasonably often.