@mjg59@nondeterministic.computer
2026-07-12 17:17 UTC
@psf@oldbytes.space these are two entirely separate issues - users should not worry about vendors leaking their information, but also even if vendors don't do that then you're still relying on the strength of your users' security. There's no way for a vendor to determine how strong a user's practices are around password reuse or ability to identify phishing, so regardless of how competent *you* are you're going to be treated like someone who uses the same password everywhere and gives it to anyone who asks
Replies (1)
-
@mjg59@nondeterministic.computer 2026-07-12 17:19
@psf@oldbytes.space but that doesn't change my original point - an attacker who has a vendor's password database and nothing else gains access to nothing if all users are using 2FA, and potentially everything if they're not. I understand your argument that this is still the vendor's responsibility, but the same applies to phishing resilience.