Hacker News Reader

> and also unambiguous to future-me. Ex: "Your worst encounter with bees occurred in what place?"

Optimistically assuming your worst-bee-encountering days are behind you, of course.

Lying in the hospital bed, the "Get well" cards decorating the space around you, the creams and ointments soothing, you realise you haven't checked your bank account since The Incident.

You pick up your phone and log in to internet banking.

"Oh no. Oh no, no, no. Why is it taunting me? Sacramento was _nothing_ to this. _Nothing._"

A tear rolls down your cheek.

Through the window a lone bee watches. The tear it sees is good, but not enough. It will go back to the hive and dance to communicate to the others your pain, but their ultimate failure in their plan. They will regroup. They will be back.

The trouble with that is that now you can never relate your amusing/horrifying story about the bees. Also consider the worrying possibility that you may have another, even worse encounter with bees.

I had a similar recent experience (not with bees, with security questions) whilst joining the Apple Developer programme. All the questions on offer assumed a conventional middle-class American upbringing and referenced experiences and institutions that I have simply never encountered. This is not unusual. Fortunately my password manager generates all the fake cats & cars & prom dates I never had.

> I think Steam is an easy example of a service which does it right: Many people (usually in different social circles) can use the same name, you can change your display name easily, other people can see some previously-used names, and you can assign custom names to friends to avoid confusion.

On the other hand, they won't let you change your login name, which would hint that they're using it as a unique identifier of some kind internally, which seems like a bit of an antipattern.

Every account has a (public) 32 bit ID, it's unlikely (though possible) that they use the login name for anything more than logging in.

While I would like to change my login name, the important thing is that it's not used anywhere else. This means it does not get in the way of my self-expression, and also that nobody who I talk to through the system can harass me by repeatedly entering wrong passwords.

Come to think of it, that also serves as a counterexample to one of the article's pieces of advice: using an email address as the users login. Steam used to work that way, which is why I have to log in using a string which is an email address I don't use anymore.

IMO separating identity from display-name is an under-used design choice, especially if you think your system needs to scale up to lots and lots of unique accounts.

The one true pattern for auth/identity has been known a long time:

http://habitatchronicles.com/2008/10/the-tripartite-identity...

One counter point -- it's pretty hard to add new steam friends by ID because often it's hard to figure out exactly which name to search for in their online tool.

You can't really add people by direct username, so you have to go by their most recently used nickname, and you get some complexity that you don't expect as an end-user.

I simply generate non-sensical answers regardless of what the questions are. For example, "What is your favorite place to go on vacation?" was a security question I recently encountered. My answer was something absurd, along the lines of "FourteenZebras".

Ok