Hacker News Reader

Comment by tootie | Hacker News Reader

I don't think password managers have as much penetration as you think and they only work on devices you own.

Social login doesn't necessarily give up that much info. Your social network knows who logged in to. The third-party only gets whatever info you accede to which usually is just an email address or name.

The huge bonus to users and site owners is that that site isn't storing a password for you. It's easy to screw up password storage.

View on HN

I think you just made a case for DuckDuckGo or (e.g.) LastPass to provided an authentication servive.

Mind you, products would have to adopt it. But from a sec + privacy perspective it makes sense to have a 3rd party whose biz model isn't to harvest your personal details.

This was OpenID, which lets you choose your third-party provider at will, or even self-host.

It's mostly dead now. People wanted the convenience of FB/GOOG/TWIT over the freedom of self-hosting.

But everybody just uses some library for that stuff, I wonder why there aren't visible "Log In with [list of 80 OpenAuth providers]" sites or services.

The issue is UX: I’d much prefer a widget that had three or four common providers and then an advanced mode that lets me pick an alternative

Mozilla Persona tried this. It was a good user experience, but it never gained enough traction and eventually they shut it down.

Maybe it could be different now? Or maybe it's not a solo effort? If multiple companies leveraged their traction (read: user base) maybe it could work.

God knows we need something. It's not safe "outside."

Reply on news.ycombinator.com