Hacker News Reader

Comment by sxates | Hacker News Reader

The best is typing that 20 character mixed-case-plus-numbers-and-symbols password for Netflix into your TV app using an on screen keyboard and directional arrows...

View on HN

I generate my passwords with:

$ head -c 100 /dev/urandom | sha256sum

Same pain as you any time I have to type the password in someplace I don't have my password manager installed, but with the advantage that its just [0-9a-f]. I figure with that many characters there's no need to use the full character set.

Also honestly just tend to use weaker passwords on things I'll need to log into on other machines. Usually those are accounts I don't care as much about anyway.

This is a huge benefit of AppleTV and having an iOS device. When the password is prompted for on the TV, my phone buzzes and I use the LastPass vault on the phone to paste the gibberish automatically.

I'm sure there are similar schemes for other devices (Chromecast/FireTV?). But when the TV itself is "smart", I bet it's infuriating.

Chromecast doesn't have its own UI or authentication, it just uses the authentication of the device the stream was started from (being able to delegate that is a requirement for chromecast support). So it solves the same issue but in a very different way. Its a pretty clever solution but requiring all interaction with your tv to happen through another computing device can get annoying.

This is so nice!

Signing into some new tvs recently, the google account sign in experience was better than Netflix sign in, as it let you use your phone to sign in (once you’d scanned a QR code shown on screen).

1Password lets you use dictionary words separated by spaces when generating random passwords. This can be really helpful on iOS/tvOS devices -- just use speech-to-text to type them in (not to mention being easier to remember).

With the recent controversy about Amazon and Google snooping in on smart speaker recordings, people should probably avoid reading out their passwords to human listeners.

I wouldn’t use Siri or Google Assistant, since those are recorded (and I’d feel uncomfortable using a Google speech-to-text feature for that anyway).

But is Apple’s speech-to-text feature (like on the iOS keyboard or in tvOS) recorded? If not, I’d venture to say I’m (currently) OK doing that with Apple services. They’ve prioritized security and privacy admirably.

How would they determine that a particular string of words was a password as opposed to any other sentence?

If it's not a coherent sentence, that would tend to be a hint. There are other explanations, admittedly.

But how is a machine supposed to be able to tell the difference? It's hard enough for humans to tell the difference between industry-specific jargon and nonsense.

Does Netflix show your full card number to you if you're logged in or is there some other justification for this level of security on it?

You need to login because accounts have different quality tiers (standard vs high definition) and different max concurrent user counts.

Hulu does this much better though. They display a hulu.com shortlink on the TV app that you type into your browser on a computer, login if you aren't already, and click a button to authorise the TV.

I know you need to log in, I meant to ask what necessitated such an overkill password for a mere Netflix account.

Netflix is needlessly hard on TV. Hotstar has an amazing system where it shows a 4 letter code. You open the website on your laptop or phone and enter the code. No typing in TV.

Reply on news.ycombinator.com