Hacker News Reader

As someone who reads hackernews and works on security systems, yes, absolutely. Run their passwords through haveibeenpwned and disallow anything that shows up.

Based on the feedback I hear from my non-tech friends and family, not allowing them to use their single password used for everything would be a good way to exclude those folks from using whatever service you're trying to sell them.

I was being argumentative there, I think the email-based auth is probably right for a site like this. Force complex passwords and people will often just do a reset every time anyway.

2FA is the standard these days for accessing PID. I can't think of data more sensitive or personal than your DNA.

Companies have legal (and moral) obligations to protect user data. Those obligations don't go away for users that don't personally care.

Perhaps not legally, but morally? I'll have a good chin-scratch on that one. Thanks for your comment.