4 ms·

Having just devoted about 12 hours to helping my wife migrate to a password manager from an ad-hoc collection of access control approaches (you don't want to kn

Having just devoted about 12 hours to helping my wife migrate to a password manager from an ad-hoc collection of access control approaches (you don't want to know), I emerged horrified by the range and domain of what I can only call incompetence and a total lack of common sense and UI intelligence. I wrote about it here (long post): https://news.ycombinator.com/item?id=24827031 https://news.ycombinator.com/item?id=24827031 I haven't quite processed this entirely yet. Part of me feels one or more adults on the world stage need to get behind what I will call a canonical approach to login, authentication, account recovery, password policies, etc. In some ways I equate this mess to what happened back when fire hydrants were not compatible with every hose coupling fire departments used. In other words, it was a mess and people got hurt. Standardization is good. Or can be good. After this weekend I can't help but think that this is another area where the web needs to seek standardization. I get the feeling that every n-th developer is rolling their own approach and the result is an absolute mess. Not advocating for an Apple solution, just saying that I had a revelation this past weekend and what I learned does not speak kindly of how this important aspect of online life is being handled.

frenchy 6y ago
I think a big part of the problem here is that the vast majority of the time, nobody wants to pay for security. The end result is that you end up with 2 kinds of players in this market: - "small" players like Mozzila who don't have a big enough marketing budget or leverage from existing products to drive adoption. - large companies who are willing to throw large sums of money into this with the goal of monopolizing auth, and using that monopoly to manipulate related markets. In the non-Apple cases (Google, Facebook, Microsoft), it also involves collecting data on users for ad targetting.

frenchy 6y ago

I think a big part of the problem here is that the vast majority of the time, nobody wants to pay for security. The end result is that you end up with 2 kinds of players in this market: - "small" players like Mozzila who don't have a big enough marketing budget or leverage from existing products to drive adoption. - large companies who are willing to throw large sums of money into this with the goal of monopolizing auth, and using that monopoly to manipulate related markets. In the non-Apple cases (Google, Facebook, Microsoft), it also involves collecting data on users for ad targetting.