LogFAQs > #968766378

Blue_Thunder posted...

Getting branded in headlines as a company with poor security is a lot worse than losing a single customer.

And tbh this is the first I've heard of someone threatening to leave a service over password requirements.

That wouldnt be their fault, though. That would be on the customer. And Ive heard of some people leaving over passwords. Not a ton, but some. Usually older, though It more like they cant get into their account. And then they stop using it. And decide that why pay if they cant use it

adjl posted...

Which costs a non-trivial amount of operator wages (especially on the scale of every tech-incompetent person out there who would use a stupid password if they weren't forced not to), results in an unsatisfied customer that will review the service poorly (which no amount of "we encourage customers to use secure passwords" will mitigate), and generally just reflects very poorly on the company.

Maybe. That said, couldnt the same thing technically happen if everybody still made easy to guess passwords while using the requirements? And I feel the operators would still have to be there, anyway

adjl posted...

Which is why they offer password recovery services. Perhaps more saliently, the most convenient way of terminating your relationship with the company (cancelling the service and removing your payment information) is locked behind your password. Even if you do decide you want to cut them off, it's generally going to be much more efficient and convenient for you to go through the password recovery process than to cancel the associated credit card or keep paying for the service until the card expires. By the time you get through the password recovery process, your problem is solved and your primary motivation to leave is gone, so the vast majority of customers annoyed by password requirements aren't going to follow through on cancelling.

This isn't to say that password requirements are necessarily handled properly (most of them emphasize entropy over length, when longer passwords are overwhelmingly more secure than more complex ones), but there's absolutely no basis to think that it might be more beneficial for a company to allow users to leave their accounts unsecured than to impose some basic security requirements.

I think you can just call and cancel, IIRC And I dont think you need a password for that. You may need some proof (or access to your email), though There are other ways, though. Depends on how much trouble the other ways would cost, though

It just seems weird to have these requirements to me, is all That said, Ive never been hacked. So, that could be why I dont see the point in it. I already hated long passwords when our job made us use these 18 digit (at least) long passwords for this one site. And it had to be changed every 3 months. And it could be any of the last 6 used. Eventually, everyone basically had the same password. Which was 1qa2ws3ed and then shift, and the same thing. And then you just move over one line every time you changed.