Totally agree. If you annoy the user too much, they will not try to circumvent your rules, they will leave and find something else to do with their time.
Also, the big question that's missing from the article is: who's the enemy? If the enemy are Russian genius hackers, then certainly very long passwords and maybe other measures are in order.
But the enemy is not always remote. I just bought a new iPad and had to reset my password and so-called "security questions".
In my experience, there are only two kinds of security questions: ones I don't know the answer to myself, and ones everyone around me knows the answer to (what was your first job, what was your surname when you were a child, etc.)
The problem is, in the case of the iPad, your enemy is not some James Bond villain in a cave in Ukraine, it's your 13 year old child who wants to use your account to buy apps, or your spouse during a nasty separation. And they both know, or can guess, answers to "security questions".
What I do personally is type random things as the answers, and write them down somewhere. But that doesn't improve security, it weakens it.
Also, the big question that's missing from the article is: who's the enemy? If the enemy are Russian genius hackers, then certainly very long passwords and maybe other measures are in order.
But the enemy is not always remote. I just bought a new iPad and had to reset my password and so-called "security questions".
In my experience, there are only two kinds of security questions: ones I don't know the answer to myself, and ones everyone around me knows the answer to (what was your first job, what was your surname when you were a child, etc.)
The problem is, in the case of the iPad, your enemy is not some James Bond villain in a cave in Ukraine, it's your 13 year old child who wants to use your account to buy apps, or your spouse during a nasty separation. And they both know, or can guess, answers to "security questions".
What I do personally is type random things as the answers, and write them down somewhere. But that doesn't improve security, it weakens it.