Hacker News Reader

Comment by saghm | Hacker News Reader

That anecdote is hilarious and scary in equal measures. Optional passwords are certainly more convenient than required ones, but so are optional PINs. The most convenient UX would be never needing to log in at all! Unless you find it inconvenient for others to have access to your bank account of course

View on HN

And the counter where the most secure system never allows anyone to log in ever

And the uncomfortable truth that the ideal level of security is much closer to the former than to the latter.

I really hate the current trend of not having passwords. For example perplexity doesn't have a password, just an email verification to login.

I hate this as well, especially since I have greylisting enabled on some email addresses, so by the time the email login is delivered, the login session has already timed out and of course the sender uses different mail servers everytime. So in some cases, it's nearly impossible to login and takes minutes...

It's the same on the sender side. Most people of course just outsource it to some SaaS like Sendgrid, and of course have some fancy microservice event bus architecture to get it there. That 'your login email has been sent' actually means 'your email has entered the very first queue, and we're hoping it makes it through all the layers soon'.

There have been plenty of instances where I tried to log in somewhere, and the first attempt to contact my mail server was twenty minutes later. And of course they then deliver all five retries at once.

Long long ago the google toolbar queries could be reverse engineered to do an i feel lucky search on gmail. I created a login that (if @gmail.com) forwarded to the specific mail.

Unlikely to happen but it seems fun to extend email [clients] with uri's. It is just a document browser, who cares how they are delivered.

That's what eBay does to me. You get to choose, at the time of login, between entering a password and getting an email verification, or just getting an email verification. At least with the bug report I had submitted to my bank, the password requirement had to be disabled from inside a settings menu, instead of being a clear option in the login prompt, but it that case it wasn't even a 2nd factor.

>You get to choose, at the time of login, between entering a password and getting an email verification, or just getting an email verification.

Ugh, I hate this. I've seen it in other places. Just waiting for them to decide that actually it should be an SMS or a phone call...

Reply on news.ycombinator.com