Passwords Are Bad UX

Christopher Cavalea — Thu, 01 Jun 2023 18:38:22 +0000

My spicy hot opinion of the week: passwords are bad UX.

Why do we force users to create passwords? Better yet, why do we force them to create a password, impose significant limitations on how they create it, and then punish them if they cannot remember it?

We live in an internet age, where web applications assist in essential and common human interactions every second of every day. Every one of those web applications requires that users create a password. And every password we require users to create makes them worse off.

Users are worse off with passwords because it creates opportunities for pain where they did not exist before. All of these scenarios occur when you force users to create a password:

Users must remember the password, or pay for a tool that will remember/create the password for them.
Users must walk through cumbersome password recovery flows if they forget their password.
Users will randomly get kicked out of applications when their auth token expires, leading to (1) and (2)
Users must monitor or pay for software that monitors every password they've ever made, in case this information is leaked to the dark web.

When a user encounters one of the above while using your application, they can attribute their pain directly to you and your app.

I would argue that it is irresponsible from a UX/UI perspective (not just a security perspective) to force users to create passwords.

Is there no better way to ensure a secure connection than a piece of text? Well, of course there is. For example, Google has rolled out passkey support for Google Accounts. This gets rid of passwords AND 2FA for Google accounts that opt in.

However, there may be other options, and I urge you all to sit down and think for a few minutes today about the question:

What would the world look like without passwords?

Aimless.js - The Missing JS Randomness Library

Christopher Cavalea — Mon, 22 May 2023 18:01:35 +0000

Hello Dev Community!

My name is Chris and I released v1.0.0 of Aimless.js on Github this week. I think it's a pretty cool utility library for generating random numbers, and I wanted to share some of the things it could do!

Check out my demo page.

My goal with this project was to create a library that made no assumptions regarding the PRNG that a user might use, and instead focus on the applications of PRNGs inside of frontend applications. For example:

import { bool, boolWithEngine } from 'aimless.js'

bool() // true/false

const customBool = boolWithEngine(() => 0)
customBool() // always false

Aimless.js provides a large variety of utilities, all of which accept custom PRNGs and create a minuscule import weight via code bundlers.

import { normalDist } from 'aimless.js'

const results = []
const mean = 0
const std = 1

for (let i = 0; i < 100000; i++) {
  results.push(
    normalDist(mean, std)
  )
}

// You can expect that the mean of results will equal 0 +/- .001,
// with a standard deviation of 1

This is v1.0.0 of a project I plan to maintain indefinitely, and I'm looking for community feedback around ways to improve it or additional utilities that the community would find useful! I will be compiling any feedback and preparing a v1.1.0 minor release in the near future.

If you like the project, share the <3 with a star on GitHub. Thank you!

DEV Community: Christopher Cavalea

Passwords Are Bad UX

Aimless.js - The Missing JS Randomness Library