Hacker News Reader

Comment by sbergot | Hacker News Reader

Obviously bad permissions are bad. But "sign-up with email" means that you need to manage you users identities which is complex and risky. You can delegate that using something like Auth0 but then it costs you money.

If I am creating a new service today I will probably won't bother and just offer social logins.

View on HN

> which is complex and risky

It really isn't, it's fairly basic. It's mostly "basic" because people have been implemented those things for so long that there basically are established patterns you can reuse with very few drawbacks.

As long as read up on how to implement it and use common sense, you can get authentication working (& being secure) under a day.

Edit: Today you can even do it the lazy way and implement "passwordless" email login as a step to see if it's worth implement the simple email+password way later. Basic steps: 1) Allow users to request login, which creates a login token in the DB and sends a URL to the users inbox 2) Allow users to exchange login token for a auth token that eventually expires somehow, delete login token from DB and store login token 3) be able to lookup if a login token is correct when hitting other API endpoints

Congrats, you now have a basic authentication scheme

That ruins the experience for all users who don't want to give you their Facebook or Twitter.

Even better: I don't have Facebook or twitter, therefore I'm out. :-)

Is "Sign-in with your Hacker News account" a thing?

I will never use social logins to sign up for anything. What a terrible idea. I assume anyone doing that is just doing it for tracking or scamming purposes.

If you have a password manager synced across browsers, like chrome or firefox's builtin ones, it should be fairly simple, right?

I really don't see how using KeePass or alt is hard, and it doesn't cost money.

If anything, it's 2FA that has me more concerned, because it has made my phone number a near single point of failure with the way everyone wants to use my phone number for it still.

You'd be excluding a whole lot of people who don't have any social media accounts, and a lot of others who aren't willing to use them for this purpose.

Reply on news.ycombinator.com