4 ms·
I'm sure they're not really overly concerned about security, but email addresses get logged everywhere on the Internet. Accounts would be pretty easy to hijack.
by bink 3y ago
I'm sure they're not really overly concerned about security, but email addresses get logged everywhere on the Internet. Accounts would be pretty easy to hijack. Maybe that makes it more fun though.
- rakoo 3y agoMaybe a publishing address is locked to a sender address after the first post, so you'd need to also hijack the sender account
- itake 3y agoI personally love low-security social networks. I consider HN to qualify (as you just need a username and password, no email verification). Small social networks can get away with it b/c they aren't big enough targets for abusers.
- pants2 3y agoAccount security is a bigger concern for the network than it is for the user. If someone steals my HN account, I won't really care (it's around my 5th account anyway). But if the hacker uses my account's reputation to evade spam filters, that becomes an issue for HN.
- itake 3y agoMost reputation scores are ephemeral, to cover the case you mentioned. I have never heard of a website that gives old accounts free passes to do whatever they way. They may have fewer restrictions initially, but if abuse is detected, they will still ban the account.
- al_borland 3y agoNot exactly social media, but when Instapaper came out they only used usernames, no password. I think the idea was that no one would care enough to delete your read it later list, and it wasn’t big enough to draw much attention. I remember it being like this for quite a long time.
- paulddraper 3y agoYour comment makes me wonder...what is HN's spam volume? I never see any.
- antisthenes 3y agoHN audience is much more likely to use complex passwords, that are not reused elsewhere. So the overall security level is probably still higher than elsewhere with 2FA, etc.
- itake 3y agoI have data that says otherwise.
- nsagent 3y agoI don't think they take security any less seriously than most social networks. If you're worried the sending/receiving servers have access to the email address, then it seems you would have to be equally concerned account recovery via email considering most email is not encrypted.
- bink 3y agoThe target email address basically includes a secret that allows you to post by sending an email to it. It's not the same thing as clicking on an email you receive to reset a password. I can't reset your password just by knowing the email address associated with your Facebook account. I'd have to intercept the password reset email.