4 ms·

One thing which I find Troy constantly misses to advertise and which I personally think is a much better solution than using password managers and each individu

One thing which I find Troy constantly misses to advertise and which I personally think is a much better solution than using password managers and each individual system having to develop their own login + verification and security system is to use 3rd parties to authenticate. I am a big fan of password managers, but I don't think there is a need for them, because WE ALREADY HAVE ALL OUR EGGS IN ONE BASKET: email. If someone gets access to your email address then they have effectively access to every single service you signed up with that email. Therefore every single service might as well just use Google/Hotmail/Microsoft/etc. to authenticate their users instead of building their own login system and asking people to come up with a new password which forces them effectively to use a password manager and yet another place to store all eggs in one basket. The password to your email account == the password to your password manager. If we would all just rely on Google/Hotmail/Microsoft/Facebook logins then we would be even more secure then everyone having to use a password manager, and it would be a much better user experience. Also I am pretty sure that Google + Microsoft + Facebook have a lot more talent + resources to secure their accounts then every new service which pops up every day. Let them do the security and you focus on your actual business value...

CM30 9y ago
This has numerous problems though: 1. Not everyone uses those email services. Indeed, for a certain subset of users (especially on technical forums like Hacker News), using them is seen as opening yourself up to unwanted surveillance. This means tech forums relying on such a system are potentially driving away a decent portion of their userbase. 2. Not everyone wants to use the same account details. For instance, if I join a site with a more professional audience, my current username (and my email one) may come across as awkward or robotic. If I join a fan forum, I might want a username based on the game or show. Etc. 3. A lot of people want to keep their online identities seperate for security reasons. I mean, do you really want to use the same email for a dating site as you do your bank? Not really, but tying the login systems of each site to Gmail or the likes means you've either compromised said privacy or given yourself another Gmail/Hotmail account to memorise the details for. 4. It encourages centralisation. We've already got a problem with a few large services having an untoward amount of influence online, and having their login systems used for numerous other sites only makes that worse. It means if they decide your site is against the rules or 'hate speech', your users can't log in. So nah, I'd rather sites didn't use third party authentication. It has too many drawbacks.
- dustinmoris 9y ago
  re 1.: Support the 10 most used email providers and you will probably cover 99% of users. Most people have a Gmail even if not as their primary email, but so they can use various Google services on Android, or an Apple ID to do the same on an iPhone. Unless you have data that suggests differently, I really don't think this is a valid issue nowadays anymore. re 2.: If you don't want to use your private email for everything, then you already must have another secondary email, because there is literally no registration process which you can get past without an email. So just use the email which you find appropriate for a given website. re 3.: Same as 2. You must have any sort of email to register anyway, so whether it's your primary email or your secondary "anonymous" email, it's still the same principle. re 4.: Not doing something smart today, because there could be potentially a futuristic abuse scenario in some point in the future is not smart. Do what's best today, if tomorrow all email providers turn evil, then re-introduce your own login system, but you'll still need these email providers to verify your users.. so not sure how far you will get... but anyways.. this is a non-existing problem today and probably never going to happen. So why degrade experience and security for a Utopian future? So yeah... I much rather use a secure and convenient auth system, because it has way too many advantages and we already rely on it, we just don't admit it. Might as well go the full length to get the best experience from it.

CM30 9y ago

This has numerous problems though: 1. Not everyone uses those email services. Indeed, for a certain subset of users (especially on technical forums like Hacker News), using them is seen as opening yourself up to unwanted surveillance. This means tech forums relying on such a system are potentially driving away a decent portion of their userbase. 2. Not everyone wants to use the same account details. For instance, if I join a site with a more professional audience, my current username (and my email one) may come across as awkward or robotic. If I join a fan forum, I might want a username based on the game or show. Etc. 3. A lot of people want to keep their online identities seperate for security reasons. I mean, do you really want to use the same email for a dating site as you do your bank? Not really, but tying the login systems of each site to Gmail or the likes means you've either compromised said privacy or given yourself another Gmail/Hotmail account to memorise the details for. 4. It encourages centralisation. We've already got a problem with a few large services having an untoward amount of influence online, and having their login systems used for numerous other sites only makes that worse. It means if they decide your site is against the rules or 'hate speech', your users can't log in. So nah, I'd rather sites didn't use third party authentication. It has too many drawbacks.

dustinmoris 9y ago
re 1.: Support the 10 most used email providers and you will probably cover 99% of users. Most people have a Gmail even if not as their primary email, but so they can use various Google services on Android, or an Apple ID to do the same on an iPhone. Unless you have data that suggests differently, I really don't think this is a valid issue nowadays anymore. re 2.: If you don't want to use your private email for everything, then you already must have another secondary email, because there is literally no registration process which you can get past without an email. So just use the email which you find appropriate for a given website. re 3.: Same as 2. You must have any sort of email to register anyway, so whether it's your primary email or your secondary "anonymous" email, it's still the same principle. re 4.: Not doing something smart today, because there could be potentially a futuristic abuse scenario in some point in the future is not smart. Do what's best today, if tomorrow all email providers turn evil, then re-introduce your own login system, but you'll still need these email providers to verify your users.. so not sure how far you will get... but anyways.. this is a non-existing problem today and probably never going to happen. So why degrade experience and security for a Utopian future? So yeah... I much rather use a secure and convenient auth system, because it has way too many advantages and we already rely on it, we just don't admit it. Might as well go the full length to get the best experience from it.