Hacker News Reader

Comment by Pxtl | Hacker News Reader

Honestly, unless you're a major cloud/OS provider like Google/FB/MS/Apple, you shouldn't be managing passwords at all. Let the pros do that. You just use an authentication standard via a 3rd party.

If you aren't big enough to maintain your own operating system and web browser, you shouldn't be storing passwords.

View on HN

I do not want to log in with Google or GitHub or Apple or anything else. I want an account on your site, even if you're bad at security (though you should at least store hashes and not plaintext passwords). Keeping track of another login is as simple as adding a new password to my password manager, and that gives me much more control over my digital life than logging into everything with my Google account.

Okay but don't come crying to me when a bunch of your users get hacked because they used the same password on your site as they use on somecrappyforum.io which leaked their password db.

I agree social SSO is the gold standard in terms of UX, but it's also a privacy disaster. What we really need is for someone to make a Let's Encrypt for login. A nonprofit that provides SSO in a privacy respecting manner.

I agree. I'd much rather "login with Firefox Login" or "Ubuntu One" than Google or Facebook for SSO. But failing that, expecting end users to manage passwords to every site (and every site to store passwords) is still irresponsible.

Reply on news.ycombinator.com