Hacker News Reader

Comment by NonNefarious | Hacker News Reader

Password policies? Ha! Let's start with the idiotic insistence that people use E-mail addresses as user IDs. Ever notice that security-critical sites never do this? I have yet to see a bank or brokerage enforce this dumb-shit policy.

https://goldmanosi.blogspot.com/2012/06/forcing-people-to-us...

View on HN

Enlighten me: If I’m registering with my favourite store’s frequent costumer program and emails are “idiotic”, do I need to take the time to pick a username for a system with absolutely no social features, or do I just memorize the 12 digit long user ID (as opposed to my email, which I need to know regardless)?

What “12-digit” thing are you on about?

User IDs should be any string that a user cares to use, as long as it’s not taken. If he WANTS to use an E-Mail address, fine. But don’t force him to.

So it is the first option - having to pick a random username for a website with no social features.

What do "social features" have to do with any of it?

I'm kinda okay with that as this ensures the average user has a password recovery path. Because we know a user never forget a password :/

And for the security-conscious among us, there are email forwarding/proxy service to hide your actual email address.

instead they enforce even dumber policies, like choose a username that has to include a number, and we're going to mask out parts of it every time we display it

Yeah, Chase bank started doing this. Talk about not getting it.

Reply on news.ycombinator.com