Hector Martin

Legacy systems. Cost. Lack of knowledge. Laziness. Lack of business case or risk analysis to support the change. Standards. Even laws.

I've worked at one of the Big Internet Companies and no offense, but all of those are utter BS. If it made UX sense it would've been done.

All that stuff applies to enterprise systems, banks, etc. Your average modern Web company has no problem w/min=12 *if* it doesn't lose users

So why aren't Twitter, Google, Facebook, and every mildly popular web startup using min=12 when it's a trivial config change for them?

Because they prefer good UX, does risk analysis and threat models, and have TONS of compensating controls instead. Good security UX.

So you're saying min=12 isn't good UX? :-) They wouldn't deploy the 300M blacklist either. They can afford to develop great controls.

I would do a risk analysis & threat models first.

My point is they do that all the time and clearly haven't concluded min=12 is a good idea. We don't have any data for that vs. blacklist.