Password Security

To start with, I'm one of those people that tends to be more security conscious than your average Internet user. That I write as much here (and elsewhere) in a public fashion was a conscious choice done after weighing out the likely risks of doing so.

I've long used complex passwords. Typically, I've used ones that were more complex than required of the systems I use. Hell, where possible, I make it so that I either need two-factor authentication or some kind of difficult to reproduce token rather than a brute-forceable password string.

Still, most web sites, applications, etc., rely on passwords. Most sites are less security conscious than I am allowing short, non-complex passwords that never expire. Of the few sites that show any level of security consciousness, it seems half-assed at best. Some sites only enforce, say, six-character passwords or, worse, only allow 6-10 character passwords. Some sites want you to have "complex" passwords, but then limit the choice of characters you can use to create that complexity.

At least one of the financial institutions I do business with falls into this limited-complex camp.

How freaking secure are your "complex" passwords when you don't allow any of ! @ # $ % ^ & * ( ) _ , or . in your passwords???

What's even more annoying about one, particular, financial institution is that they expire their passwords every 45 days. Now, this isn't an institution I deal with on a regular basis. My day-to-day bank allows me to pay all my bills from their portal. This other institution, I only log into when I need some information. So, every time I log in, I have to change my damned password and deal with the fact that they don't allow me to make my passwords as complex as I'd like. Even more fun, they don't allow me to re-use any of the last dozen passwords.While this is good, in theory, given my access frequency, that means it's going to take nearly two years before I can recycle. Now, given that they hamstring me on the passwords I can/would set, it makes memorization of the password even harder. So, pretty much every time I do log in, I have to go through the "I forgot my password" hassle. If they let me set the passwords I wanted, they'd be good against a brute-force attack for a number of years (basically, a cracking tool would have to work through several hundred quadrillion combinations to stumble on my particular combinations). But, no. I'm stuck with passwords that are several orders of magnitude less complex.

Good Food; Bad Website

I love Stachowski's products, but their website is rubbish. I mean, I'm pretty sure it's put together by the guy who runs their market stands. Nice guy, but, clearly not a graphic designer or marketer by trade.

Web Design Priorities

At the end of the day, humans are who read and use the content you publish. You really should optimize your readers' experience than search engines. Granted, search engines are frequently how users get to your site, but, if you sacrifice human usability for machine usability, those search engine "driven" users won't come back.

How to Piss Me Off (Website Design)

Ok, I'll admit, there's any number of things that a website can do wrong to piss me off and make me not want to return, make me add a 127.0.0.1 mapping for your site to my system's hosts file, etc.


Annoyance #1: Making me chase links to get to teaser content. Biggest offenders (and current residents of my hosts file) 2leep.com, zaparena.com, outbrain.com, neatorama.com and wahoha.com. Others will likely follow as this seems to be an increasingly popular method for "driving traffic". Look, when I see an interesting-looking link on a web page, if I bother to click on that link, I want to immediately go to that story. I don't want to be taken to a page full of new links from which I then have to click on the link that takes me to the content I was originally interested in. I just want to get to that content. If you then exacerbate things by causing a new tab to open for each link I chase, it pisses me off further. If you get really obnoxious and cause entirely new windows to open, it makes me absolutely furious. It makes me want to find your servers and take a hatchet to them. Once done with them, I want to find you for similar treatment. Since this isn't exactly "practical", I just blackhole you.


Annoyance #2: Making every link (or even just a significant percentage) I click on open a new window or new tab. If I want a link to open a new tab or window, I'll right-click on the link and tell my browser to do it. You have no business forcing me to browse any differently than I want to. If you try to force me to browse differently, I'm gonna blackhole you. If I am a member of your web site and you've added this annoyance as "an improvement" to your site or through a site redesign, I will either immediately cancel or allow my membership to lapse (mostly, this will depend on whether I had a paid membership or not) - there are many ways to improve or redesign a site, fucking up navigation is not one of them.


Annoyance #3: Disabling or otherwise fucking up my right-click functionality. I get that you're trying to "protect content" or something, but disabling right-click doesn't do it. If you're sending something to my computer, there's any number of ways for me to "steal" it. Right-click is just the most convenient. Disabling right-clicks disables any number of functionality that I find useful - not just easily saving content. When you disable my right-click, you don't protect your content, you just inconvenience me. I really dislike being inconvenienced. I tend not to re-visit sites that inconvenience me.


Annoyance #4: Requiring plugins, especially uncommon ones, so that "designing" your site is easier for you. Trying to dictate to me which software (and associated security vulnerabilities) I have to run on my computer just so you can hire brain-dead site "designers" is not a sound business model. It alienates people. And, if you want to use these gee-whiz plugins, provide a least-common-denominator model for accessing your site. If your site isn't (meaningfully) usable without plugins, your site isn't usable. If a site ain't usable to me, I ain't gonna re-visit. And, again, if you introduce these issues as part of a "redesign", I will drop my membership in your site.


Annoyance #5: Using a site design that could have come from MySpace circa a decade ago. Keep your design clean, simple and easy to navigate. Use things like conformant CSS to achieve good design. Anyone can write HTML. It's really not that hard. All you need is notepad, vi or the like. And, because "anyone" can write HTML, it's really easy for it to look like you let someone who's read "HTML for Dummies" design your site. If I go to your site and it feels like a migraine, seizure or puke-session feel eminent, I'm not coming back. It's (sorta) ok for personal sites to look like amateur-hour, not professional or subscription-based sites. And, it's really not even ok for personal ones, given the number of sites out there like Blogger/BlogSpot that make it dead easy to create a site with canned-templates.


Annoyance #6: Using an obviously templated design. If I go to your site, the only way I want to know you're running a given set of software is by badging. I don't want to go to your site and say, "ah, they're using WordPress Template 'X' to run their site". I don't want to look at your site and be able to guess what you're running. If I can look at your site and make that guess (even if it's wrong), it means you aren't trying very hard. You aren't trying to create a specific experience. Learn enough CSS (etc.) to create your own, unique look.

Above all, if your site is subscription-based, there has to be something about it that makes it worthwhile. A site that looks amateurish, "canned" or otherwise "low-effort" makes it seem like you're more interested in my money than providing me a good experience. At the core, I know that's always the case, but you shouldn't be bald-faced about it.

Clue Alert: You Are *NOT* a Designer

The problem with making it easier to "design" web sites is that it makes it so more people think they're designers.

If the results of your efforts to hand-crank HTML and CSS were trifling before this "nifty" tool, chances are rather high that your results after the new tool will be trifling. Just because it now looks like every other site using the same development tools doesn't mean that any of those sites look particularly good. For starters, for a site to stand out, it has to be both good and unique. You can't stand out by looking like everyone else.

In the end, junk is junk. All that the various design tools do is make it easier for junk to be thrown out there.

My Kingdom for an "Empty Trash" Button

Ok. I get it: storage is dirt-cheap. No one, except old-timers, bothers to empty their trash or otherwise permanently delete things. That is, they don't until/unless they get an "over quota" hate-mail from their administrator. But, given the oodles of space Google and the like make available, you're unlikely to ever see an "over quota" type of notification.

Some of us, however, are in the habit of cleaning up after ourselves. Some of us do like to empty our trash cans. And, in the end, permanent deletion should be a one-, maybe tow-click process - whether there's one or a million items to do away with.

I'm guessing that Google doesn't really have a "human factors" team involved in their design process. If they did, the travesty that is their method for emptying trash wouldn't exist. To finish the delete process, you have to:

1. Open the trash folder
2. Click on the "checkmark actions" button
3. Select the "Select All" menu (or, individually check each message on the page)
4. Click on the "Delete Forever" button
5. Click on the "OK" button to confirm that you actually want to make it all go bye-bye
6. Repeat 1-5 for each page worth of presented messages

Nowhere is there simply an "empty" trash button that allows me to say "nuke it all in one, swell foop". Hell, it wouldn't even be quite so horrible if I had the option to increase the number of items displayed per page (I mean, most sites let you choose the number of objects to display - frequently in an increment dropdown of like "10, 25, 50..." - sometimes they'll even offer an "all" display-option). That way, I could nuke my 300 messages in less than the thirty iterations of steps 1-5 (above) that the current scheme seems to require.

C'mon, guys: you're engineers. Most engineers I know like to minimize their effort. As it currently stands, if I want to nuke out my 300 messages, I have to take like 150 discreet actions. Does that make any kind of sense? Fuck: if you were to offer a "GV Premium" who's only feature was an "empty trash" button or a "change number of items displayed per page" dropdown, I'd sign up for that "premium" service.

Q&A Instead of "Real" Search?

So, FaceBook is coming up with a Q&A "service". It's going to be a zero-privacy, zero-filters proposition. Basically, anyone can ask, anyone can answer and there's not much you can do about it. Intentional anarchy. Well ...with one exception: it won't be indexable by search engines. Speculation being that this is a shot over the bow of Google with the hopes being that it would be a "first stop" for people that have questions. That people would hit FB Q&A, get their answers and not have to go the next step to Google (et. al.) and FB could reap the advertising rewards.

Now, I've used a lot of forums over the years. Some were truly designed to be help-oriented. But, generally, the first responses given - particularly in tech circles - were of the form, "did you RTFM" and/or "did you Google it"? So, clearly, there's plenty of people that either can't be bothered to do research on their own or are willing to wait for answers rather than finding them on their own. I guess this is part of why KGB was born (haven't seen commercials recently, but their website's still there, so, they're probably still around). Granted, useful answers can be found - particularly if you display a level of clue in the asking of your questions. But, if you've got clue enough to ask your questions well, you frequently aren't going to be use a simple Q&A site.

I've also used a few, more entertainment-oriented Q&A sites. They were always a mixed-bag, however.

One of my favorites was Wis.DM (RIP). It was a lot of fun. I still don't know whether its creators intended for it to be serious or not. Not sure anyone that those who became regular users saw it as a site for serious answers - mostly it seemed to just a way of initiating discussions (and flame wars - made me miss Usenet, sometimes). Unfortunately, it died. It's users scattered to the four winds, but many stayed in touch (a few of my FaceBook friends I know only from Wis.DM). Some found homes on new Q&A sites - some making their own in an attempt to recapture some of the magic that had been the Wis.DM experiment.

I've tried a few other sites, since then. Unfortunately, for what I was looking for - semi-interactive entertainment - they were too serious or so pointlessly stupid as to be unbearable. The first place the Wis.DM crowd fled to was Fluther. Unfortunately, it was very restrictive - particularly for someone, like me, who likes to post a lot. Worse, Fluther's community and moderators didn't react terribly well to the recreational questioners that flooded in when Wis.DM died. However, they apparently have a niche and they're doing well enough, these days.

Google once tried a Q&A service, but it was kind of a bust. They shuttered it at least four years ago. 

Yahoo still has their Q&A site. My primary experience of it is through sites like YahooAnswerFail.com. It didn't have the social aspects that Wis.DM did and tended to have lower utility than Usenet did. So, for people like me, though, the lampoon sites that have more value than the actual. They act to distill the most humorous aspects of the site into convenient, easy to find morsels.

I just don't see that FB Q&A is apt to be any better than Yahoo answers. We already have a couple FaceBook humor distillers (e.g. FailBook and LameBook). Do we really need an FBQnAfail.Com site? The world can always use more humor, I suppose.

Oh well. Should all be interesting to see how it all plays out.