Dude, someone at MS understood security just fine. And they knew that if they had good security, that would eliminate an entire ecosystem of fixes for security that MS could get its fingers into.
You don't make something which never breaks, because then how do you make money on spare parts.
MS security is insecurity
"8 chars" is crazy talk. All passwords should be at least 15+ chars and allow spaces, so that people can use phrases. When we push the idea of 8 chars, we push people to using leet (733t) swaps which are hard to remember and easy to guess. 8 chars is also too short on a complexity level. The obligatory xkcd is both clear on this and right. Correct horse battery staple.
Accounts should be locked when the password is strongly suspected of compromise. So if you see someone try the same password for many accounts, any account with that password should be locked.
That should be automatic, and there should be a solid way of unlocking. I do not have any such solid unlocking method though. Security questions are a really bad idea for a number of reasons. 2FA works but not when someone's had a major (or often minor) life catastrophe. I'd really like to see some sort of last-resort identity notary system which works -- but that 'which works' part is hard.
They have every business being in the job they're in. That job is to prevent lawsuits. Therefore you do what the industry says is best practice, so your lawyers can point to that in court. Industry says "hire the people with certs" then makes money selling certs. Certs cannot teach THINKING, so they're about box ticking. You get the sort of people you expect from that. (If you get one who does think, he cannot deviate from the box ticking because he is smart enough to know if he does that he is the one who will be blamed when something not under his control allows access.)
The company's covered. Problem solved.
I don't see a solution here. I'd love to hear one which would actually work.
"The whole thing should be managed by a secure (as secure as we can make it) package in the OS that all browsers and other apps can use."
This is a formula for forcing us to do all work on one device. That doesn't fly. Many people need multiple devices, and devices break/die.
Until the site is compromised. Then all your uses of this across all sites are a massive security hole. These are simply bad. There's never a good security question or a good answer.
This is the only appropriate response to security questions, but means if we ever lose or are away from our password manager, we are hosed. You can remember your password for an important site, but three other unique passwords, and which nonsense question they're attached to?
No, they are all bad. Because unless you make up a unique answer "Q: What street were you born on? A: hsbh12312" you're violating a central password rule -- never use the same password on different sites. A compromise of one site allows access to all the others which use the same question.
Yes, and so can you ex-husband, who knows the answers to all of those.
2FA is the mote. Security questions are the beam. That needs to completely go away overnight.
It's insecure sites demanding personal information which can then be used to compromise secure sites. And it's information any abusive ex-spouse would know.
I agree. This is a job for lawyers and lawsuits. There does need to be an industry reference standard, though -- so that the lawyers can say "I'm just a simple caveman. Your 'Accept conditions' button looks like a beetle and makes me hungry. But even I can see that my client is due 14m USD in damages due to your negligence in not implementing this simple industry standard."
That will change policies fast -- any company with a legal department will find they need to implement a standard overnight. And there will be a gold rush for consultants implementing that standard.
They are FANTASTIC for most people who own a garage. If you have a garage and haven't bought a cheap old EV beater, you do not know what you're missing.
"Stop touting electric cars as they're a one-size-fits-all" is a straw man. Nobody is doing that. The vast bulk of garage owners is not everyone by a LONG shot, and the EV community knows very well that people without garages have a crap time with EVs. But we also know most people complaining about EVs don't have one and share other common traits.
The fast charging is generally not due to the vehicles. I know that doesn't change your peeve, but call it what it is. The charging market is a gold rush and an amazingly profitable business in theory -- they're marking up a product by 500% or more and don't have to even ship it. Of course a bunch of incompetent carpet baggers/ambulance chasers/pick your own aphorism jumped in and produced a system which doesn't work.
But you're almost never going to use it anyhow. You'll charge in your garage overnight, and pay almost nothing for the energy. You'll drive 30 miles or so, because in theory you're an average American, and you'll get home to charge at home again without using a fast charger. I've owned an electric car and never used a fast charger even ONCE in it. (If you don't have a garage, do NOT buy an EV. Period. Wait for the dust to settle, or your experience will be terrible.)
If you are driving cross-country routinely, you're an OUTLIER. If you're doing it once in a blue moon, use your other car, rent a car, or plan carefully.
Today's EVs have fantastic range. They generally have 8-10x the range an average person needs daily. Either the vast majority of people who complain about EVs are far from the mean in use, or people just don't have realistic understandings of their own actual needs.
The very first Prius had a gas engine which was not very different from ones Toyota had been making for many, many years. They knew how to build them and had long since made them reliable. The Prius then, after the first generation, stabilized and was produced for years. All the issues which came up were addressed and polished/refactored to make subsequent builds more reliable. Toyota really knows how to make Priuses now.
All the electric cars on the US market, with the exception of the Leaf and the Teslas, are new models. The first generation cars were all completely redone. There's no polishing of an existing good design, here. EVs are inherently much more reliable than ICE cars, but there are many trivial, stupid mistakes to find in any design, and all the good EVs are really divergent from the well-known patterns. A couple of things need to happen before things get reliable -- we need to go through this big phase of experimentation, and we need to have models continue with only minor changes for years. It's just a bad time and will be for years. But it's not the motors which are at fault here, or the power controllers, etc. It's the deeply buried thermistors, sensors, wiring harness changes, and frankly the fear and lack of education on the part of body shops for example -- if you have a fender-bender, you're likely to find the body shop won't touch your EV.
I was talking to a Niro EV owner who was not happy with the car because he was having issues with a bunch of senors. Nothing at all to do with the fact that it was an EV -- everything to do with the explosion of change in cars going on right now and the fact that all those gizmos are new.
I don't think all that is a reason not to get an EV. But it's a helluva good argument to get as cheap a used EV as you can, and let the wealthier folks, car leasers, and the fleet buyers ride this rough patch out for you.
I've owned a cheap EV for about 5 years now and have never had a lick of trouble with the EV part of it -- I had to fix the struts, a seat, and a dome light. I love the thing, and my next car will be an EV too. But I am trying to find a simple one, cheap.
The federal gov gets a LOT less (very roughly 1/3) in tax than they give out in subsidies yearly. The states make roughly 20-30x the tax that the fed gov does. So it's the states that care about the gas tax revenue. However the side costs of gas cars effect both the federal gov and states, and the costs are huge -- annoyingly they are amorphous: The cost of the war in Ukraine is due to gas cars and fossil fuels in general, as Russia, like a lot of countries we bump with militarily, is a petro-state. The cost of asthma and other health issues is born largely by the sates. The cost per mile of gas cars is much higher when people are able to charge at home, and so the people bear the brunt of the gas car cost directly. All in all, gas cars are a massive drain financially on the US and the world.
It's really our inability to focus on many aspects at once which makes it difficult for us to move in a way which benefits all of us financially.
(EVs are currently a gain for people with personal garages and not a cost-benefit for people without them. We should be figuring out how to maximize the ability to cheaply and conveniently charge EVs overnight for city-dwellers, so everyone can pay less for transportation and the massive hidden costs of gas cars.)
If all else fails, lower your standards.
