Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: I have 176 logins/accounts. How many do you have?

news.ycombinator.com

Post reply on HN
Print view View original

241–250 of 300 posts

Re: Ask HN: I have 176 logins/accounts. How many do you have?

#241

Post by kdklol »

My BW stands at 52 logins right now, but it's not yet quite complete. I think I'm missing a couple banks. Over the last year or so however, I cancelled almost 100 accounts, ranging from obscure forums, trough hosting providers, to facebook. It was a herculian effort, as companies put up emmense barriers (especially the hosting companies), but I somehow got it to the minimum I can realistically have - which is roughly 60 I think.

I try to avoid SSO, only exceptions are a single forum, which had broken registration, and my uni. Why? 1. SSO is a single point of failure, which you (unlike BW) cannot audit yourself; 2. You have to trust it's not gonna sell your data - perfect graph of services one person has is of course very juicy information; 3. They the make management of one's accounts slightly harder, as you cannot easily know how many you have by looking into your BW; 4. You are locked into your SSO service.

For MFA, I use fido keys (yubikeys), which I have to highly, highly recommend. Not only are they miles ahead of anything else, but they are also so easy and quick to use. I have a little one permanently in my usb port and to log in you just touch it. I'd recommend this if you are MFA-fatigued. Obviously, I always take the best form of 2FA available regardless.

All passwords in BW are long random alphanumeric and I have a XKCD-style password for that and something similar for FDE/logins into computers.

BTW, getting BW was the best decision I could have made, not really for security (although that's obviously the point) but fkr convinience. No more silly variants on passwords and no more guessing emails for reset.

Re: Ask HN: I have 176 logins/accounts. How many do you have?

#242

Post by atq2119 »

magicalhippo wrote: post #182
KronisLV wrote: post #29

Around 300 at this point, sans any deleted ones. I don't think I know a single password anymore, since they're all randomized and separate for each site. > Obviously, anything with OAuth is "bundled" into my Google account. Maybe it's just me, but I try to never use centralized identity providers (outside of things that I really don't care about) and use separate e-mail auth whenever possible, across multiple e-mail…

Similar, around 290 personal accounts. In addition comes the logins and such for various internal services like Home Assistant, PiHole etc. Total over 400 in my password manager. I keep wishing for something better. A great start would be to reduce friction, by having some standardized interop between browsers and a password manager. Like, my browser shouldn't know or care about passwords, it should just mediate the…

Quite the contrary, having the browser be the password manager is the way to go, and it works well today.

My only complaint is around data portability. Exporting and importing passwords should be hassle-free.

Re: Ask HN: I have 176 logins/accounts. How many do you have?

#245

Post by str3wer »

xp84 wrote: post #36
KronisLV wrote: post #29

Around 300 at this point, sans any deleted ones. I don't think I know a single password anymore, since they're all randomized and separate for each site. > Obviously, anything with OAuth is "bundled" into my Google account. Maybe it's just me, but I try to never use centralized identity providers (outside of things that I really don't care about) and use separate e-mail auth whenever possible, across multiple e-mail…

> people getting banned … with no ways of getting in contact with the support This is the most out-of-whack part in my humble opinion. Most of us have a tremendous amount of data and things like auth tokens tied up in Google, and Apple, and due to their scale and the fact that at least for GOOG it’s a “free service,” they’ve set the expectation up that “support” should be limited to searching an FAQ, and also that an…

at least they now let download all datas when they ban an account(source: two weeks ago they accused me of being a bot, still waiting for a response to my appeal but meanwhile i've been able to download my stuff)

Re: Ask HN: I have 176 logins/accounts. How many do you have?

#247

Post by kdklol »

rhn_mk1 wrote: post #137
akira2501 wrote: post #58

If I need to login to your site less than once or twice a year, "Forgot my password" is my password manager. Personally, I feel that the utility of me working to keep and maintain that information in a database for high availability is essentially zero. As a result, I store very few accounts overall and checking out as "guest" hasn't been a problem of any sort. There's like 10 critical things that I feel the need to…

A password manager is not just a way to manage passwords. It's also a way to manage who holds your personal data, so you can GDPR request them to stop.

This. It's so valuable just to know how exposed you may be. I know a guy who missed a data leak and later got one of his accounts stolen. I think his Steam? It was way back in the day... For him, it was a cheap reminder to take passwords hygiene seriously. For someone else, it could have been a someone-took-out-a-line-of-credit-in-my-name reminder.

Re: Ask HN: I have 176 logins/accounts. How many do you have?

#248

Post by plugin-baby »

slt2021 wrote: post #228
akira2501 wrote: post #58

If I need to login to your site less than once or twice a year, "Forgot my password" is my password manager. Personally, I feel that the utility of me working to keep and maintain that information in a database for high availability is essentially zero. As a result, I store very few accounts overall and checking out as "guest" hasn't been a problem of any sort. There's like 10 critical things that I feel the need to…

problem is that sometimes these websites takes forever to send password recovery email. especially if they use some sort of cheap cloud service to send email/sms, then it can take 15-20 minutes to receive password reset link have you not encountered cases like these?

GoDaddy is one example.

Re: Ask HN: I have 176 logins/accounts. How many do you have?

#250

Post by kdklol »

johngalt wrote: post #200
morkalork wrote: post #55

Shit, just looking at the replies, there's a solid case for password managers. No normal human is going to memorize 100+ unique passwords meeting various complexity requirements. It almost makes shaming people for re-using passwords look like you're out of touch. Of course they're following bad practices, how could they not be?!

It's a solid case for FIDO2 keys. - Inherent MFA that is faster and more secure than SMS codes, or app notifications. - One pin code and/or biometric to remember rather than hundreds. The answer isn't to add another layer of management to passwords, but to eliminate passwords as a method of authentication.

This. This is the only thing that actually solves all warts of authentication nowadays. Companies really should switch to a webauthn-first mindset. The technology has been here for over a decade, it's not new. There is a standrad and a library for every language, it's not hard. FIDO2 keys start at 20 bucks and every android phone can act as one, it's not expensive. They are literally the only thing that can actually protect you from phishing and they generate new login creds per domain, protecting your privacy. Companies, support webauthn!
Post reply on HN