Impossible to set my password.

I changed my email address and, I don't know why???, I receive this message : Your password from LittleGolem.

This mail was generated on base your change of email address.

Your login: largowin
Your new generated password: qygerymu

Thank you for using www.littlegolem.net !

And now, I have a generated password and it is impossible to change it, because I have no place to give my new one like you can see on the picture at this link: http://cheznoir.com/z/littlegolem.png Like you can see, I only have a button to reset it, but when I click on it, I receive a new password... For info, I use Safari on my mac.

I dont think little golem allows you to chose your own password, which is pretty weird.

By the way, you shouldn't post your login and password in the forums.

@Largo: Christian is correct. If what you gave above is your actaul password and some random characters, should reset it (there's a link at the Edit user profile page.)

(and not some random ...)

It is one of the bizarre things about littlegolem that you cannot set your own password but can only be assigned a random 8 character password.

But I had my own password before... Littlegolem reset it automaticaly when I wanted to change my email address!!! Very strange...

@Christian: I tried some other times to reset my password after the first email, and this is not the last one I wrote here to show the notice I received...

Well you are still vulnerable to time travelers.

Seems that I will get any answer from the admin of this website...Strange attitude..

You can keep resetting it to a random string until you randomly get the password you want after a few thousand years or so... :)

I think this policy was introduced many years ago, but it wasn't always the case. It was associated with some security issue. Perhaps some accounts were getting dictionary attacked, I forget...

If the users all chose their own passwords, there would be some users whose passwords could be guessed by spammers or other ill-intentioned attackers. If all the passwords are random 8-characters strings, it's unlikely any can be guessed.

Note: Some of the above should be qualified. E.g. an 8-character password is susceptible to an "offline" attack, but the above is implicitly about an "online" attack.
Also, if the stakes were higher here, LG would need more serious security, like https for passwords and session cookies.

It would be nicer if the system would let users pick their own passwords and the system would simply reject too-easily-guessable passwords (checked via any of a number of freely available password checking tools), instead of forcing users to not be able to pick their own passwords. No other site I use forces users to not be able to pick their own passwords.

Personally I use random passwords far more secure than merely 8 lowercase letters, for example, so in my case the system forces much WEAKER passwords onto me than I choose for myself.

Carroll, I freaking hate that XKCD - it's one of the most ignorant ones he's ever posted. He's clearly devoid of any deep understanding of information theory or human cognition.

donkey pin cell, right?

@FatPhil, I know you are a security expert, care to elaborate on where he's wrong?

donkey pin cell,
did you mean Pin The Tail On The Donkey?

Carroll, when Phil visualizes the scene that xkcd uses to remember "correct horse battery staple", it looks to him like "donkey pin cell". ("cell" is the proper term for some of the things I've always called "battery".)

Anyway, I endorse Bruce Schneier's suggestion to use unguessable random passwords and keep them written down on slips of paper. We all have a way of keeping valuable slips of paper around, in a wallet. The advanced persistent threat s are foreign governments and hackers that aren't going to pick your physical pocket.

Your own government is also a threat, always.

Receiving a password as a text message to your phone is the safest, right?

I'm not terribly worried that anybody is going to hack my lg account, no matter the password.

Ad if it's compromised, oh well. Maybe the hacker plays better than I do.

Of course, we're helped that our login does not need to be our screen name. But really, I think this is about as low a risk situation as you can get.

The problem with the xkcd strip is that it suggests you should be able to remember your passwords. (It is quite unwise to reuse passwords among different sites.)

But for most people, it's simply not realistic to be able to remember the dozens of passwords we need for our many accounts these days. Truly random long strings, kept in a convenient password manager program like KeePassx, or on physical paper in your wallet, are far more secure, and more usable than trying to remember dozens of passwords to dozens of websites (or using some simple manual hash system based on the URL, another popular method of having site-specific passwords).