Hacker News Reader

I was also talking about the paper by Cormac Herley from MSR. The lasting value of the paper is not the specific best practices that are not being applied. Those are examples of the claim people are being rational when they ignore security advice. The value in the paper is in the idea that users are acting rationally, and backing that up with some math and concrete examples.

View on HN

I should not have called the article irrelevant, but instead stated that it needs an update to include modern techniques, practices and risk factors.

One of his examples in 7.3 User Effort is not Free he mentions the users time in input of a 6 digit pin vs an 8 digit password. But he doesn't include the use of a password management system. If you use a password managment system you can actually save time on password input.

Then look at his section on passwords. The same thing applies. And the article is not security advice but it contains security advice from 2009 which is different today.

Reply on news.ycombinator.com