Hacker News Reader

Comment by jordanpg | Hacker News Reader

I disagree. The OP is talking about usability, first and foremost. Everything you said is true, but none of it speaks to usability and UX.

I agree so strongly with the bulleted points made, that it made me imagine a standard, a symbol of compliance. Sites complying with all 6 points could use some sort of validator, like W3C.

Sites/apps that make me sign up for something trivial, sign up through FB only, won't allow me to use my global identifier (my email), or limit the length of my password, are often rejected (by me) out of hand. I simply don't have the time or the patience to deal with their special circumstances and they need me more than I need them, 99.9% of the time.

This is great consolidated advice.

View on HN

Not sure you guys disagree! The parent said, "Maybe you don't display it as an "account", but I can't think of a single commercial website where you shouldn't at least be taking an email address as part of the transaction."

Then #3 on the bulleted list of six points says, "Username = Email. Don't make people remember a username for your site. You may allow them to pick a username later on that can be used in lieu of their email address, e.g. as the URL for a profile page, but don't force them to use a username to log in."

The quoted list is under "and if you do offer accounts..." on the blog post, and that's totally, utterly wrong for many sites. So yeah, if the OP thinks this advice is good enough to merit a verification badge, we disagree. The advice is bad.

It can make all the sense in the world to make "accounts" a very lightweight thing. But if you're taking payments or doing anything that might conceivably result in a user support request (e.g. storing user data or taking some action on their behalf), then you need to have some form of registration. And once you have registration, you'll need to have some way to prevent drive-by registration by total strangers -- otherwise you'll start getting complaints from people that some jerk/spammer signed them up for your site.

There are reasons that this stuff exists, and authentication always deserves careful thought.

Man, I'd get behind a standard and stamp for this, it'd save me so much time!

I'm sick of accounts. Fuck accounts, I've got hundreds of the little shits, every one a looming security time bomb. Most of them I cannot delete. I've just stopped making them now, which locks me out of pretty much every new product, but I consider it worthwhile in exchange for not creating more accounts.

There are better ways of doing this shit though. For example, firefox hello does not require an account like skype does. It just makes a hyperlink with a unique ID, and I can share it.

If you need to track the customers transaction, why not link it to a unique URL?

Reply on news.ycombinator.com