Hacker News Reader

Comment by vyrotek | Hacker News Reader

So what happens when I pick a secret phrase that someone else already uses? I can technically sign in as the person who originally created it now.

Yes, if you do it right the chances are slim. And perhaps it doesn't matter because there isn't any sensitive data.

View on HN

It's not that slim in my opinion. Even though this is HN we're talking about, many people are lazy enough to only come up with something really simple. Or a pop culture reference.

It's part of the experiment.

Can't you say the same about the regular username + password implementation?

Or are there smaller chances of that happening if you separate the login data into two different parts, like username and password?

Is it just a psychological difference, or is there something more there?

Basic statistics says yes the chances are much much smaller if you have both username + password.

The larger the password and the more obscure the password means that chances grow smaller of someone else choosing it but that doesn't mean everyone uses large and obscure passwords.

The logistics of it are different. With username + password, 2 people can have the same password. So you only need to warn someone if the username has already been taken. But in order to warn someone that a secret phrase has already been taken, you've just given them all the info they need to login as that other person.

That being said, if you were to enforce that the first half (or some undisclosed portion) of the secret phrase couldn't be taken, then you'd be closer to comparing apples to apples.

Reply on news.ycombinator.com