Hacker News Reader

Comment by laumars | Hacker News Reader

While I do agree with you in sentiment, I don't think it's always better than passport sites.

The problem with every site handling their own logins is that you're creating more vectors for attack. Most people reuse passwords (bad practice I know but it is what most non-technical people do) and not all sites are properly secured - in fact some don't even encrypt passwords! So at least passport sites outsource the data protection issues to larger businesses that you'd expect (no; demand) to have experience to handle that data securely.

View on HN

Oh god every time I see this argument it makes my blood boil.

It's 2014. There's no excuse for re-using the same damn password over and over again.

And it doesn't make sense to make the situation worse for everyone else because they don't care about their online security.

Get a yourself a damn password manager and use a unique password for each service then we can kiss all these password leak problems goodbye.

Time after time we see people making a big drama because company X had all their 50 million password leaked. Oh was it hashed? Oh was it salted?

If you use a unique password for each service, the service provider can store your password in plaintext and you will be safe.

That's what I do and I couldn't care less if all the passwords in the world are leaked in plaintext.

You're right in principle but couldn't be more wrong in practice. I certainly don't have time to educate all 7 billion people in the world about password managers and you're clearly doing very little in that area either (aside kicking off condescending rants at your peers....) so deliberately implementing a scheme that's shit for 99% of the worlds internet users just so it's better for last 1% who are technically minded is just elitist and wrong.

Which ever solution is implemented needs to work for all groups of internet users - not just yourself ;)

I personally favour the passport/OpenID idea, from a user experience point of view.

In contrast to the problem you've stated, if I were to exclusively use my Google account to log into websites, it becomes a single point of failure if the service was down, and if it were to be compromised.

> In contrast to the problem you've stated, if I were to exclusively use my Google account to log into websites, it becomes a single point of failure if the service was down, and if it were to be compromised.

Very true. Sadly there's no real right or wrong answer here; a single point of failure but a better secured portal, or a decentralised network with arguably less secured portals.

Personally I try to use a balance of both: Twitter passports for sites I don't trust and passwords for sites I do trust. But that's just my personal preference.

> Very true. Sadly there's no real right or wrong answer here; a single point of failure but a better secured portal, or a decentralised network with arguably less secured portals.

This is exactly right. And, as you mentioned above, there are more kinds of people out there than are present in this thread.

I have a password manager and generate a new random password per site, so I don't have any desire to use a single log-in for almost all sites. However, many (most?) people reuse a single password (or a handful of them), and until that changes, they're likely much better protected by having a single well-protected authentication point.

There are more vectors for attack, but the damage for any given one is more self-contained ... when there's one giant target, on the other hand, sure it's harder to get in, but if you do you've gotten into everything.

Absolutely. I'd already discussed this point though: https://news.ycombinator.com/item?id=7857655

Reply on news.ycombinator.com