Hacker News Reader

Comment by vanburen | Hacker News Reader

Usernameless always seemed like an optimization too far to me.

I think it's totally reasonable, and probably a good thing for users having to use their username at login. Especially as it reminds them what username they are using for that service.

I could totally see a situation where a user uses a Usernameless passkey for years to access a service and for some reason loses access to the Usernameless passkey, and then has also forgotten the username for the service, so cannot even start an account recovery process.

View on HN

> Usernameless always seemed like an optimization too far to me.

I think it depends on the service. But aside from the occasional forum or social site, usernames are just an extra step. I don’t want or need one for banking/administration/ordering a product. For better or worse, email is usually a better identifier, assuming you already need one for other reasons (like you say recovery is typically needed).

> Especially as it reminds them what username they are using for that service.

Like passwords, forced usernames are hard to remember, if you use different ones. If you use the same, then it leaks privacy across services. (Technically usernames can be private but the expectation from decades of social sites is they are public)

> […] loses access to the Usernameless passkey, and then has also forgotten the username for the service

Correct, no identifier at all can’t be recovered. Hence, email.

Or you can just use a verified email as a username...

> email is usually a better identifier, assuming you already need one for other reasons (like you say recovery is typically needed).

If you remember which one you signed up with, and it wasn't your work email from two jobs ago.

There's no account recovery process for passkeys. I thought they are your identity?

No, that's like having only one key to your house.

If you have two passkeys from different providers, they serve as backups for each other. And there are other alternatives, like a printout of recovery codes.

No, your person is your identity. Passkey don't pay for services, people do. So there is always a recovery process, at least for any business that actually values you as a customer.

Reply on news.ycombinator.com