Sure. Strong parameters is more flexible in that you can control the mass assignment per controller or even per action level, whereas the white list approach operate on the model itself. I still feel nervous about password being attr accessible, it's just a hidden bomb and could be exposed if not careful (update user action?), and with pretty severe consequences. 

Agree with you on the roadmap though, and eventually all this will go Rails 4 with strong parameters, and this is a fix before that