Hacker News Reader

Comment by donkarma | Hacker News Reader

if you're having issues with disposable emails, you need to either add phone verification or make it so people can try your service (or view prices!) without signing up

View on HN

phone verification sucks, though. I refuse to use anything that has it mandatorily. And disposable emails are also a problem because of spam.

Yeah, Instagram started demanding a phone number for my personal account that I've had for many years. I just stopped using Instagram.

Yeah I'm the same way, unless I -really- need the service like the place work or my bank, they don't get my phone number.

Just get rid of the password and require email based magic link login.

Fine use a disposable email but the account will be wiped soon when you never log back in again.

Please no. I hate services that do this, it takes longer to jump over to email and open a link then to autofill the info with a password manager and click submit.

Password managers should start supporting this flow. Allow the password manager to read your Gmail, or for cloud-based managers log up with an @1password.com email... Not trivial technically, and maybe turning password managers into SSO providers, but that's a lucrative business in itself.

At that point we'd be better of figuring out a proper protocol that allows websites to talk to the password manager directly.

Mozilla designed a decentralized authentication protocol back in 2011 called BrowserID, which was later standardized by the IETF. IIUC, it was similar to OpenID but sites would authenticate your identity with your email service provider. Unfortunately, the protocol never gained traction.

https://en.wikipedia.org/wiki/Mozilla_Persona

Something like OpenID connect?

Well, ideally without the centralized server in between.

Don't we already have that with WebAuthn? It should be possible for the authentication request to be directed to the password manager. Less secure than using a hardware key, but more secure than password, email, or text message authentication.

That looks like it could work, though I don't think it has a lot of support from either password managers or websites.

I don't want anyone but me reading my email. I just want to use password with 2fa an we all good.

If you're masking your email because of privacy concerns, are you really going to be happy to go through phone verification?

it provides a small financial cost which is enough to limit spammers while letting legitimate users through

I have a VoIP number that I ported from an actual cellphone carrier, so that it isn't normally flagged as part of a VoIP phone number range.

At least I can turn it "off" when I don't expect a phone call or text message.

Reply on news.ycombinator.com