Hacker News Reader

Comment by kpanghmc | Hacker News Reader

Am I the only one who kind of wishes we never went down this "let's fix authentication!" rabbit hole? It feels like we've just replaced one problem with another.

Now, instead of simply having to remember what username/password combination I used, I have to remember which (if any) OpenID provider I used, how much information about myself does said provider expose, and how to merge my accounts when I inevitably end up choosing the wrong provider and create a duplicate account on the site.

View on HN

Did you read the article? This is an attempt to fix all those issues you list.

BrowserID only fixes those issues if it ends up as the only game in town. Otherwise, it's simply going to be tacked onto the end of a daunting list of other OpenID / BrowserID providers that users will have to choose from.

So now when your email address gets hacked, ALL your usernames and passwords to every website are also hacked!

At least with normal un/pw you need to request a password reset from the website.

I don't think we should be tying logins to email.

by tying all your logins to email, you're left with only one account that you can focus on keeping secure and un-hacked (or a few, as BrowserID allows for multiple emails). The BrowserID is also in talks about support one-off identity generation via the browser, bypassing email on sites which you don't want to identify with.

BrowserID supports password reset requests, which can be built into the browser

email is the single most user-recognized signifier of identity we have on the internet today. tying identity to anything other than email just seems silly

You see, passwords suck. Big time. They are extremely vulnerable to brute-force attacks, people forget them, people write them down on post-it notes, and people use the same password on every single site. Not to mention that the website has to store your password securely, and not every website has amazing track record doing that.

Passwords make the world less secure.

So we need to replace them with something. And that "something" has to be secure and easy to use.

Turns out that this is a difficult problem to solve, so we keep trying. I agree that OpenID is not exactly the perfect solution, but it doesn't mean that there is no problem to solve.

I never said that there wasn't a problem. I'm simply saying that the solutions we've come up with so far have not yielded a net gain. If anything, the site owners that I know who have incorporated OpenID / Facebook Connect / etc. into their sign up / login forms have said that they have to answer more questions from users having login issues than ever before.

I like this approach specifically because it doesn't have to replace the traditional sign-in process. A BrowserID sign-in button can be added to a traditional sign-in form without any fuss, and users can either use it or ignore it. And if the BrowserID sign-in is broken, then no worries, the traditional sign-in form works anyway.

Reply on news.ycombinator.com