Post

This blew my mind: cphpost.dk/2026-10-10/n... Not sure who needs to know this, but 123456 is not a secure password.

I once worked on a large system with millions of users, an oversight meant that clear text passwords were being output in the log files. Astonishing how many were `123456` or `password` or `hello`, or any number of other easily guessable alternatives.

Doesn't surprise me at all, unfortunately. I imagine the rise of in-browser password managers has helped, but most folks want to get right through the login screen and do their jobs. Understandably.

Yeah! I don't have numbers, but social login is a good thing to delegate control to. Ofc there are risks, but few will lose their google creds. Magic links and/or forgot password is a good option too. Changes authentication from "a fiddly string to remember/store" to "go to my inbox"