Comment by aimor | Hacker News Reader

Comment by aimor | Hacker News Reader

Logging in.

First I need to make an account for nearly everything.

Then I need to link that account to a phone number or email.

Then every time I use the service I need to wait for them to text or email me a password.

If they email me the password then I have to log in to my email, which means getting another password texted to me.

Alternatively if it's work related I have a physical key card, a physical password generator, and a slew of personal passwords I just memorize. I have to keep all of these on me just to log in: regular keys, cell phone with service, email, key card, password generator, and ideally a different password memorized for every service which need to be changed every 60-180 days.

Maybe an example is needed, this is a typical day: I want to use the building's front door, so I use the key card. I want to use my office door so I use my regular key. I want to use my laptop so I use a memorized password. I want to connect to the network so I use my physical password generator with a memorized password. I want to read an encrypted email so I use a memorized password. I want to download a file from a document share with another company so I use a memorized password and get texted a password. I want to use the computer lab so I use a key card and a memorized password and another key card and another memorized password. I want to buy something online so I create a new account with a memorized password and get emailed a password so I log into my phone with my thumbprint and my email with a memorized password and get texted a password. Then I buy the thing with a credit card number and code which I've memorized since I get so much practice memorizing things now. I probably verify my identity a hundred times every single day, and businesses seem to be adding more and more ways to do it, making it more and more difficult.

I remember being impressed by my grandfather's keychain when I was a child, thinking "wow, how can someone need this many keys?" ...

It seems like no matter what improves in this area, something else breaks it. At first using a password manager helped. So now everyone wants to email or text a code if they don’t recognize the device/browser. But there’s a checkbox to remember the device/browser! And I find more than half the time the checkbox has no apparent effect.

There’s like a Murphy’s Law of Logins: Whatever frustration can be caused, will be.

For logins that are important, I appreciate the extra security of 2FA and am not frustrated by it.

Also, for many people they re-use the same password for everything, so enforcing 2FA makes sense for them as well

I don't think anyone is complaining about the option of 2FA on logins that are important. What people are complaining about is the requirement of 2FA which only supports email, text, or call. All of those options take significantly more time and distraction than my normal 2FA processes (TOTP or WebAuthn). Furthermore all of those options add next to no security because all you have to do is get physical access to someone's phone (not unlocked, just access to the lock screen!) to receive the codes. And even if that's not possible you can just bribe or SE a $telco employee.

Complaining that my car key weighs 10 pounds isn’t a prompt to remind me that people steal cars.

Reddit used to be amazing. "Just pick a username and password. Give us your email if you want to be able to do a password reset."

Now an email (with verification) is required and you'll still get insta-shadow-banned.

Actually, no, an email is not required. It's a dark pattern. You just need to click "Continue" without entering any email address.

Some subreddits (like /r/linux) will delete your comments if you don’t register an email though.

Wow, is that an official option for mods?

They just program the Automoderator bot to delete those comments

Hmm, it gave me an error message and wouldn't let me continue until I had put in my email address a few weeks ago when I was making a throwaway. Not doing it now though. I suppose either they're experimenting or maybe they just don't like my ISP.

What's a physical password generator? Sounds interesting.

Could be referring to diceware https://theworld.com/~reinhold/diceware.html

I use 1password for everything, and as great as it is, it isnt a seamless and bulletproof solution. No password manager is. The log in experience is EVERYWHERE and I have to generate new passwords seemingly everyday for new sites and apps.

I use Bitwarden but I know what you mean

A token generator, a little device where you push a button and get a password. Sorry that the language was confusing, I wanted to make the point that tokens, codes, keys, whatever they want to call them are another password.

Ah I see, you mean 2FA or Two-Factor Authentication, right?

This is why I love Reddit and Wikipedia. You can make an account, but you don’t have to. Compared to say Pinterest, where content can’t really be accessed at all unless you make an account.

Reddit doesn't deserve the love. Forced to login to view content (for everyone that doesn't know 'old' exists), can't download their videos, ban bots that present a downloadable link, obnoxious popups to download their apps, unable to reject cookies on 'old.reddit.com' without first going to 'new.reddit.com' to set preferences, trick users into giving them your email, etc.

Hell, reddits' interface is so terrible and slow that its a basic requirement to get an account solely so you don't have to use it.

Reddit is literal evil. Last time I used the new Reddit, the up vote scores and comment counts change in real time on the screen. Like what the fuck.

Is there a fuzzing algorithm used on votes so that early in the voting you can't tell whether it's up or down?

There are also some subs that hide vote counts for a period of time. I assumed this was just a more aggressive way to stop the spam votes.

First off, you absolutely do have to make an account to participate on Reddit. Second, screw Reddit, between shadowbans and required external IDs to register and the various new anti-user design updates... No, they're not a positive example of anything anymore.

get a password manager. some of them are quite good and will even fill out usernames and passwords which makes maintaining a junk account for non essential websites easier to use

Reply on news.ycombinator.com