10 ms·

I've actually not signed up for services at all because the couple username variants I tried were already registered. I was also recently annoyed at being forc

I've actually not signed up for services at all because the couple username variants I tried were already registered. I was also recently annoyed at being forced to switch to a new system for my credit card, and it's a unified system with all their other cards and banking customers, and still uses "username" (instead of email) as a login, so of course my name was taken. I decided to just append some random characters, and then realized I could just generate my entire username and have been doing that since, when I don't care about identifying myself to others. My password manger saves it, so it really doesn't matter to me.

kbenson 9y ago
> then realized I could just generate my entire username and have been doing that since, when I don't care about identifying myself to others. My password manger saves it, so it really doesn't matter to me. Even better, if they have your email and use it for password recovery, you can basically turn it into a two step authentication by not saving the password and using password recovery every new time you need to log in. Though, that can get annoying if their password recovery takes a while to send.
- rando444 9y ago
  Creating two-step authentication for yourself, but allowing attackers to have one-step authentication... interesting concept.
  - fbdjskajxb 9y ago
    If you are making up random usernames on a banking site, attackers aren’t going to know your username. So it is two-step. This is not a great idea if you have a public profile connecting your username to your email because someone can hack your email. But you not knowing your password doesn’t hurt your security as far as I can tell.
    - rando444 9y ago
      Assuming an attacker can't know your information is not a good idea. Your login information can be gained via keyloggers, network sniffing, phishing scams, malware, malicious employees, and all sorts of other methods.. This is why two-factor authentication is so important, to help prevent your account from being compromised in the event that your username and password is.
      - deleted 9y ago
        [deleted]
      - fbdjskajxb 9y ago
        The part I don’t get is how not knowing your password makes the situation worse. The password recovery mechanism exists whether or not you use it every time you log in. The way I see it, not knowing your password removes some potential threats around managing that password incorrectly, at the cost of increasing the risk of losing access to your account if the recovery mechanism doesn’t work.
        rando444 9y ago
        It doesn't make the situation worse, you're the only person suggesting that. It offers some extra security, but very little. It's the digital equivalent of locking your back door but not bothering with the front door.
        fbdjskajxb 9y ago
        >It doesn't make the situation worse, you're the only person suggesting that. The comment I originally responded to seemed to think so.
    - tjoff 9y ago
      If you are making up random usernames on a banking site, attackers aren’t going to know your username. So it is two-step. The username isn't supposed to be a secret, social engineering will most likely be very easy.
  - kbenson 9y ago
    As your sibling comment correctly inferred, this would hopefully be done after setting some sufficiently hard random password on the service in question. At least that's how I've seen it described by those here that have mentioned they do it. A sufficiently large random unknown password is actually significantly less likely to be brute forced than the service itself is to be exploited.
- cyberferret 9y ago
  It seems that the EnvKey app/service does this. You only register with an email address, and if you need to log in to the app, it will email you a one time password to use. Nowhere near as inconvenient as it sounds - It is the sort of service that you would rarely log in to. Mainly when setting up a new server or adding a third party service to your list of environment variables on your server. I can see that for a service that you would use several times a day (Twitter etc.) then it would be a major PITA.
  - kbenson 9y ago
    > I can see that for a service that you would use several times a day (Twitter etc.) then it would be a major PITA. Well, even then, it depends on how long sessions last in combination with your browser cookie policy. How often do you authenticate your HN account?
    - cyberferret 9y ago
      True. Long running sessions would help. There are those that would argue it is a security risk though. Even EnvKey that I mentioned above has a session cookie of some sort - I can usually use the app for several days after logging in, even if I close the app - but after that I am prompted to instigate the email with my unique login key.
      - kbenson 9y ago
        It would be nice if we eventually got to a point where control of whether a password was even allowed, how long your session cookies lasted, and the ability to list and invalidate all existing sessions was as common and expected as a password reset system.
- hawski 9y ago
  I'm toying with an idea of a SMTP proxy service so you could have a SMTP server on your smartphone. I would like to use Let's Encrypt certificates so my service would be just a dumb pipe. Then you could register using random email for every service. SMTP would handle signal outage as message would be eventually received. Or one could set up secondary SMTP server in DNS. I would like to give an option of subdomains handling. So every email would be on different subdomain. That would make blocking easier. So you would have addresses like: foo@mjlptle3sq.emailproxy.net It would only be for receiving. I know that there are lots of options already: 20 minutes mail, user+whatever@gmail.com or just a catch-all. But this could at least provide somewhat end to end encryption.
  - mseebach 9y ago
    The idea of having easy to use single-use email addresses is good, but I don't think it's practical to run an SMTP server on a smartphone (you need the relevant ports open and forwarded through various NATs) and email anonymisers are already banned from signup on many sites, so *.emailproxy.net would quickly be, too.
    - chii 9y ago
      it'd be cool if you could use an ip as the mail domain, and simply having an (easy to use) app running locally allowed that IP to receive email.
  - cuckcuckspruce 9y ago
    If you're serious about this, consider running UUCP as the mail transport. It can be tunneled through SSH easily (or have TLS applied to it with something like stunnel), allows either end to initiate a transfer of data (assuming open ports), handles dynamic network addresses easily, and will likely be a much smaller drain on mobile phone batteries. Plus it can allow sending and receiving of email and files, if you so choose.
    - hawski 9y ago
      I will look in to it. I'm serious but my todo list is quite long. I was thinking about dedicated application on phone for it instead of regular mail client. Mainly to provide easy interface to manage big amount of accounts, banning hosts etc. Also then the app could just use service like Google's Firebase Cloud Messaging. That would wake my app and then it would get a message. I hope that it is fast enough that a sending SMTP server would not timeout.
- foxhop 9y ago
  Although I disagree that it's two step authentication in the general use of the term, I actually built this type of authentication flow into Remarkbox (https://www.remarkbox.com https://www.remarkbox.com) It works really well for most users although it does have some quirks.
  - kbenson 9y ago
    How is it not, even in the general use of the term? Instead of site username and site password plus a separate token to a previously agreed upon authenticated service (whether phone or email account), it's site username and site account email (hopefully hidden), and a token sent to a previously agreed upon authenticated service. If your account name and associated email is known, it's not really better than a username and password (except that it's delegated to what should be one of your strongest accounts that you protect more diligently), but if the email is not generally known for that account name then it's extra identifying information that must also be known to access the service account.
freehunter 9y ago
I’m annoyed at banks that require my username to have numbers in it but only let me pick an 8 character password.
- Frank2312 9y ago
  That's because your password needs to be "easily" entered through the phone call service.
  - hx87 9y ago
    High quality speech recognition is ubiquitous in phone services these days so that isn't a good reason. Besides, if I want to set a 16 char password and am willing to enter that on a keypad, what's the problem?
    - dylz 9y ago
      Don't worry, you can enter 16 characters, but it only will care about the first 8, everything else can be random when you log in. Also, if you have an a, b, c, or 2 in your first character, you can use any of them in place of that character index to log in.
reaperducer 9y ago
As banks have merged and eaten each other over the years, I've ended up going from four different website to log into to one website with four different usernames. There's no way to merge the online accounts, even though the banking accounts are merged and I can see all of the financial information from each no matter which login I use.

kbenson 9y ago

> then realized I could just generate my entire username and have been doing that since, when I don't care about identifying myself to others. My password manger saves it, so it really doesn't matter to me. Even better, if they have your email and use it for password recovery, you can basically turn it into a two step authentication by not saving the password and using password recovery every new time you need to log in. Though, that can get annoying if their password recovery takes a while to send.

rando444 9y ago
Creating two-step authentication for yourself, but allowing attackers to have one-step authentication... interesting concept.
- fbdjskajxb 9y ago
  If you are making up random usernames on a banking site, attackers aren’t going to know your username. So it is two-step. This is not a great idea if you have a public profile connecting your username to your email because someone can hack your email. But you not knowing your password doesn’t hurt your security as far as I can tell.
  - rando444 9y ago
    Assuming an attacker can't know your information is not a good idea. Your login information can be gained via keyloggers, network sniffing, phishing scams, malware, malicious employees, and all sorts of other methods.. This is why two-factor authentication is so important, to help prevent your account from being compromised in the event that your username and password is.
    - deleted 9y ago
      [deleted]
    - fbdjskajxb 9y ago
      The part I don’t get is how not knowing your password makes the situation worse. The password recovery mechanism exists whether or not you use it every time you log in. The way I see it, not knowing your password removes some potential threats around managing that password incorrectly, at the cost of increasing the risk of losing access to your account if the recovery mechanism doesn’t work.
      - rando444 9y ago
        It doesn't make the situation worse, you're the only person suggesting that. It offers some extra security, but very little. It's the digital equivalent of locking your back door but not bothering with the front door.
        fbdjskajxb 9y ago
        >It doesn't make the situation worse, you're the only person suggesting that. The comment I originally responded to seemed to think so.
  - tjoff 9y ago
    If you are making up random usernames on a banking site, attackers aren’t going to know your username. So it is two-step. The username isn't supposed to be a secret, social engineering will most likely be very easy.
- kbenson 9y ago
  As your sibling comment correctly inferred, this would hopefully be done after setting some sufficiently hard random password on the service in question. At least that's how I've seen it described by those here that have mentioned they do it. A sufficiently large random unknown password is actually significantly less likely to be brute forced than the service itself is to be exploited.
cyberferret 9y ago
It seems that the EnvKey app/service does this. You only register with an email address, and if you need to log in to the app, it will email you a one time password to use. Nowhere near as inconvenient as it sounds - It is the sort of service that you would rarely log in to. Mainly when setting up a new server or adding a third party service to your list of environment variables on your server. I can see that for a service that you would use several times a day (Twitter etc.) then it would be a major PITA.
- kbenson 9y ago
  > I can see that for a service that you would use several times a day (Twitter etc.) then it would be a major PITA. Well, even then, it depends on how long sessions last in combination with your browser cookie policy. How often do you authenticate your HN account?
  - cyberferret 9y ago
    True. Long running sessions would help. There are those that would argue it is a security risk though. Even EnvKey that I mentioned above has a session cookie of some sort - I can usually use the app for several days after logging in, even if I close the app - but after that I am prompted to instigate the email with my unique login key.
    - kbenson 9y ago
      It would be nice if we eventually got to a point where control of whether a password was even allowed, how long your session cookies lasted, and the ability to list and invalidate all existing sessions was as common and expected as a password reset system.
hawski 9y ago
I'm toying with an idea of a SMTP proxy service so you could have a SMTP server on your smartphone. I would like to use Let's Encrypt certificates so my service would be just a dumb pipe. Then you could register using random email for every service. SMTP would handle signal outage as message would be eventually received. Or one could set up secondary SMTP server in DNS. I would like to give an option of subdomains handling. So every email would be on different subdomain. That would make blocking easier. So you would have addresses like: foo@mjlptle3sq.emailproxy.net It would only be for receiving. I know that there are lots of options already: 20 minutes mail, user+whatever@gmail.com or just a catch-all. But this could at least provide somewhat end to end encryption.
- mseebach 9y ago
  The idea of having easy to use single-use email addresses is good, but I don't think it's practical to run an SMTP server on a smartphone (you need the relevant ports open and forwarded through various NATs) and email anonymisers are already banned from signup on many sites, so *.emailproxy.net would quickly be, too.
  - chii 9y ago
    it'd be cool if you could use an ip as the mail domain, and simply having an (easy to use) app running locally allowed that IP to receive email.
- cuckcuckspruce 9y ago
  If you're serious about this, consider running UUCP as the mail transport. It can be tunneled through SSH easily (or have TLS applied to it with something like stunnel), allows either end to initiate a transfer of data (assuming open ports), handles dynamic network addresses easily, and will likely be a much smaller drain on mobile phone batteries. Plus it can allow sending and receiving of email and files, if you so choose.
  - hawski 9y ago
    I will look in to it. I'm serious but my todo list is quite long. I was thinking about dedicated application on phone for it instead of regular mail client. Mainly to provide easy interface to manage big amount of accounts, banning hosts etc. Also then the app could just use service like Google's Firebase Cloud Messaging. That would wake my app and then it would get a message. I hope that it is fast enough that a sending SMTP server would not timeout.
foxhop 9y ago
Although I disagree that it's two step authentication in the general use of the term, I actually built this type of authentication flow into Remarkbox (https://www.remarkbox.com https://www.remarkbox.com) It works really well for most users although it does have some quirks.
- kbenson 9y ago
  How is it not, even in the general use of the term? Instead of site username and site password plus a separate token to a previously agreed upon authenticated service (whether phone or email account), it's site username and site account email (hopefully hidden), and a token sent to a previously agreed upon authenticated service. If your account name and associated email is known, it's not really better than a username and password (except that it's delegated to what should be one of your strongest accounts that you protect more diligently), but if the email is not generally known for that account name then it's extra identifying information that must also be known to access the service account.

freehunter 9y ago

I’m annoyed at banks that require my username to have numbers in it but only let me pick an 8 character password.

Frank2312 9y ago
That's because your password needs to be "easily" entered through the phone call service.
- hx87 9y ago
  High quality speech recognition is ubiquitous in phone services these days so that isn't a good reason. Besides, if I want to set a 16 char password and am willing to enter that on a keypad, what's the problem?
  - dylz 9y ago
    Don't worry, you can enter 16 characters, but it only will care about the first 8, everything else can be random when you log in. Also, if you have an a, b, c, or 2 in your first character, you can use any of them in place of that character index to log in.

reaperducer 9y ago

As banks have merged and eaten each other over the years, I've ended up going from four different website to log into to one website with four different usernames. There's no way to merge the online accounts, even though the banking accounts are merged and I can see all of the financial information from each no matter which login I use.