Conversation

Notices

1. Embed this notice
   Matthew Lyon (mattly@hachyderm.io)'s status on Wednesday, 13-Dec-2023 02:29:44 JST Matthew Lyon

   Are you responsible for copy on a website that manages user accounts? Does it offer people an affordance to reset their passwords? Does the copy for doing so use the phrases “forget”, “remember”, or otherwise suggesting that people should store the password to your site in their heads?

   You should change that.

   And while you’re changing it, you should remove any *hint* of shaming around the process. Shit happens, and passwords need to be reset.

   • Embed this notice
     Claudius (claudius@darmstadt.social)'s status on Wednesday, 13-Dec-2023 03:03:01 JST Claudius

     in reply to

     @mattly not currently in charge of such a site, but what would be your gold-standard suggestion? "Reset Password" or something else?

   • Embed this notice
     Sören (chucker@norden.social)'s status on Wednesday, 13-Dec-2023 07:03:07 JST Sören

     in reply to

     • Ja-AH-AH-n Lehnardt :couchdb:

     @mattly @janl and while you’re at it, add a well-known URL! https://github.com/w3c/webappsec-change-password-url#proposal

     (I think Safari, Chrome, 1Password support this now)

   • Embed this notice
     Matthew Lyon (mattly@hachyderm.io)'s status on Thursday, 14-Dec-2023 03:46:59 JST Matthew Lyon

     in reply to

     while I’m on the topic:

     if your website’s login form doesn’t work with common password managers, it’s broken. Period.