Hacker News Reader

As username is public, it provides no security. So 1 account password with likely low entropy has been replaced with application-specific high-entropy passwords. This is an improvement.

View on HN

Wouldn’t the low-entropy password still work on the web interface, and if so why is it an improvement? Any brute force attempts can very well be done on the web interface, and if there are countermeasures why can’t they be used on the API endpoints?

Isn't the idea you would have 2 factor auth on your account preventing any web brute force.

Then generate API keys on a per project reducing the attack surface in the case of breach?

Yes that’s correct, but if you choose to not use 2FA for whatever reason I don’t see why password auth shouldn’t be supported on the API instead of making you waste time generating an API key that won’t actually improve security in any way (since attackers can brute force the account anyway).

Reply on news.ycombinator.com