Hacker News Reader

Comment by robconery | Hacker News Reader

The problem is less that it's easy to forget - it's more that it's easier to completely lose someone. For instance, you forget your login to HN and you can go through a reminder process - pretty simple. You forget your Open ID you're in a world of pain.

Moreover most sites can't help you - the URLs contain (usually) no information about you as a person. So you come to me and say "I don't know my login" or worse: "My Open ID provider is gone".

All I can do is shrug. The it becomes a matter of sleuthing: IP addresses, PayPal transactions (if you use them)... and so on.

I agree it can be better - but it's technology that when mixed with users is a nightmare.

View on HN

Same as email accounts now; lose one, or it goes under, and you're in a world of pain because those handy "forgot password" links are tied to that. Moreover, most sites can't help you - the emails contain (usually) no information about you as a person.

All of which is only solved by alternate means of identification. ie, GMail lets you specify a cell phone, many other sites have pseudo-personal questions you have to guess to perform a reset without a password / email, etc. What reason is there that a site can't ask a series of questions to re-point an account to a new OpenID?

None of this is any different. At all. The only difference is in managing one OpenID vs widely varying logins on every site on the internet.

> lose one, or it goes under, and you're in a world of pain because those handy "forgot password" links are tied to that.

That requires two failures: you forgot your username/password and you lost your email account. That's not the same as forgetting your OpenID or having the provider go down. If you've got username/password, then email is the alternative means of identification. One of the main points of OpenID is avoid giving alternative means of identification, such as an email address.

No. Lose your email, and you lose your account. Your sign-up email is probably in there, and the new "owners" can go click the "forgot password" link.

You don't need it, if you remember your login and password then you login and change your email. You're not going to sign up with an email that you've lost.

You seem to be under the mistaken assumption that this sort of thing will a) inform you you have lost your email account, and b) will only occur after you've noticed.

Give me your email account. I can nearly guarantee you I can have 5 sites with new passwords inside 5 minutes. And that's by hand - anyone serious about this could write a couple scripts to grab dozens of the major sites in seconds.

I'm under no such impression, I'm just pointing out the obvious flaw in your previous post.

Reply on news.ycombinator.com