Hacker News Reader

Comment by mehrdadn | Hacker News Reader

Having only a password is just fine for many sites. The real problem comes up when you have to show it as an identifier to a third party. If you don't ever need to do that, all you need is a password, not a username. (Auditability of login information within a company notwithstanding -- isn't really something a user can try to enforce, and it can happen in a variety of ways. As a user, at the end of the day, you trust the company with your credentials, and assume they secure internal access in some fashion.)

View on HN

Imagine all you have is a password, and I come along to register, attempting to set my password to "hunter2". Turns out someone else has already used this. Do you allow me to continue or tell me the password is already in use? If its in use - great, I'll just log in using that other guys account!

Of course, you could let the site specify the password, which would work if they're long and random. But social security numbers are neither of those.

Nobody said they should let you choose your own passwords. We were comparing with SSNs, which are assigned to you, not chosen by you. You'd do the same with such passwords. And nobody claimed SSNs are appropriate passwords either.

>And nobody claimed SSNs are appropriate passwords either.

Except for the US government, and most banks, medical providers, and cell phone companies.

This is a good point - not all services need both identification and authentication.

I've noticed some sites using identification only (like the days of IRC), so you can have a consistent identifier to interact with people but a username isn't actually secure or owned. The converse should also be possible, in the same sense that a bank PIN is used to authenticate with no public identifier involved.

That said, for many offerings we should consider "a company employee" to be a third party. There are already employees with access to my data, but the outsourced call center employee who answers the customer service number probably isn't one of them, and I want them to be able to look up my account details without being able to impersonate me.

Reply on news.ycombinator.com