4 ms·

Jesus fucking christ. Stop making websites accept anything other than a username+password/token for authentication, and this kind of retarded shit would never h

by lhgaghl 13y ago

Jesus fucking christ. Stop making websites accept anything other than a username+password/token for authentication, and this kind of retarded shit would never happen. It's somehow still the status quo to make backdoors to recover your account incase you lock yourself out, which is why things like this happen all the time. You get what you deserve.

jtheory 13y ago
This is great in theory, but in practice your regular customers are going to lose/mix up their usernames and passwords all the time. They need some kind of back door to recover their access (because honestly, even for the responsible and tech-savvy users, sometimes sh!t happens... e.g., my password manager generated a new password but my laptop crashed before I could save it), and they assume there will be a way to restore their account. I'm sure you could tell your customers "you get what you deserve", but not if you want them to remain customers.
- lhgaghl 13y ago
  Gee, you're going to have a hard time with bitcoin, hidden tor services, etc. A) Customers locking themselves out of accounts B) Accounts being stolen by identity theft Pick one. > I'm sure you could tell your customers "you get what you deserve", but not if you want them to remain customers. I kill people for a living. You can tell me I could stop killing people for a living but then I'd stop having customers. Thus it's impractical to stop killing people.
  - lhgaghl 13y ago
    Oh wait, I forgot this is HN, where conforming to retarded dogma is the only way to be cool.
    - frou_dh 13y ago
      Please impart more wisdom in your lovely obnoxious raging nerd idealist way. It's very unusual to find in tech circles!
      - lhgaghl 13y ago
        Ironically, HN itself so happens to do it right - it permits you to have only a user/password. Reddit is the same, so is github, stackoverflow. I've never heard of pervasive problems on either of these sites. I don't submit my email to these sites, and they work fine. Please continue to call common fucking sense idealism. Look how shit any other site besides the 4 (and others like them) I mentioned are with their fancy policies. How can anyone not rage when such stupidity is forced upon us?
        frou_dh 13y ago
        Even if customers are scatterbrained and unwilling to accept responsibility for themselves, it's still better to keep them on board and making money than trying to teach them a lesson out of principle that probably won't even stick. How well any policies are actually thought through is another matter.
        lhgaghl 13y ago
        Yes, because users would hate so much to be told explicitly that all they need to remember is a password. They much rather have 20 different pieces of information, some combinations of which if they share, people can take over their accounts on various services. </sarcasm> The problem is not so much that the systems suck, the problem is there's no way for people like me to take on the responsibility and "risk" of just having a simple way to authenticate myself. For example, in my bank I would opt into having all "suspicious transaction" types of protections turned off, but if I went to my local branch and asked for that, they'd just get confused and think I'm trying to commit fraud. > it's still better to keep them on board and making money Maybe better for you, assuming there would be a net loss from turning off the bullshit policy. Definitely not better for customers, as it enables theft, which has the same consequence as forgetting a password.
  - danielweber 13y ago
    Once again proving my point that the biggest impediment to Bitcoin is the Bitcoin community.
lhgaghl 13y ago
BTW, this comment was meant to be in response to the other thread "How I Lost My $50,000 Twitter Username (medium.com)" https://news.ycombinator.com/item?id=7141532 https://news.ycombinator.com/item?id=7141532 But they're both pretty much the same problem. Service has complex/secret authentication policy, so users have no chance to be secure.

by lhgaghl 13y ago

jtheory 13y ago

This is great in theory, but in practice your regular customers are going to lose/mix up their usernames and passwords all the time. They need some kind of back door to recover their access (because honestly, even for the responsible and tech-savvy users, sometimes sh!t happens... e.g., my password manager generated a new password but my laptop crashed before I could save it), and they assume there will be a way to restore their account. I'm sure you could tell your customers "you get what you deserve", but not if you want them to remain customers.

lhgaghl 13y ago
Gee, you're going to have a hard time with bitcoin, hidden tor services, etc. A) Customers locking themselves out of accounts B) Accounts being stolen by identity theft Pick one. > I'm sure you could tell your customers "you get what you deserve", but not if you want them to remain customers. I kill people for a living. You can tell me I could stop killing people for a living but then I'd stop having customers. Thus it's impractical to stop killing people.
- lhgaghl 13y ago
  Oh wait, I forgot this is HN, where conforming to retarded dogma is the only way to be cool.
  - frou_dh 13y ago
    Please impart more wisdom in your lovely obnoxious raging nerd idealist way. It's very unusual to find in tech circles!
    - lhgaghl 13y ago
      Ironically, HN itself so happens to do it right - it permits you to have only a user/password. Reddit is the same, so is github, stackoverflow. I've never heard of pervasive problems on either of these sites. I don't submit my email to these sites, and they work fine. Please continue to call common fucking sense idealism. Look how shit any other site besides the 4 (and others like them) I mentioned are with their fancy policies. How can anyone not rage when such stupidity is forced upon us?
      - frou_dh 13y ago
        Even if customers are scatterbrained and unwilling to accept responsibility for themselves, it's still better to keep them on board and making money than trying to teach them a lesson out of principle that probably won't even stick. How well any policies are actually thought through is another matter.
        lhgaghl 13y ago
        Yes, because users would hate so much to be told explicitly that all they need to remember is a password. They much rather have 20 different pieces of information, some combinations of which if they share, people can take over their accounts on various services. </sarcasm> The problem is not so much that the systems suck, the problem is there's no way for people like me to take on the responsibility and "risk" of just having a simple way to authenticate myself. For example, in my bank I would opt into having all "suspicious transaction" types of protections turned off, but if I went to my local branch and asked for that, they'd just get confused and think I'm trying to commit fraud. > it's still better to keep them on board and making money Maybe better for you, assuming there would be a net loss from turning off the bullshit policy. Definitely not better for customers, as it enables theft, which has the same consequence as forgetting a password.
- danielweber 13y ago
  Once again proving my point that the biggest impediment to Bitcoin is the Bitcoin community.

lhgaghl 13y ago

BTW, this comment was meant to be in response to the other thread "How I Lost My $50,000 Twitter Username (medium.com)" https://news.ycombinator.com/item?id=7141532 https://news.ycombinator.com/item?id=7141532 But they're both pretty much the same problem. Service has complex/secret authentication policy, so users have no chance to be secure.