Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: I have 176 logins/accounts. How many do you have?

news.ycombinator.com

Post reply on HN
Print view View original

261–270 of 300 posts

Re: Ask HN: I have 176 logins/accounts. How many do you have?

#261

Post by kdklol »

Biganon wrote: post #208
willtemperley wrote: post #93

Earlier quoted context omitted.

This. SMS 2FA has been considered insecure by NIST since 2016 [1] and it's a major pain when travelling and swapping sim cards. [1] https://www.theregister.com/2016/07/24/nist_says_sms_no_good...

I was thinking this with my health insurance website (which uses SMS 2FA), and I realized the problem is you can't expect your average Joe to know how to manage a TOTP 2FA correctly. SMS might not be the most secure, but it's probably better than 1FA, and absolutely everyone can use it. Enter your number, receive text, boom.

There are other options though Couldn't a health insurence company make an app? Or do SSO trough google and such? Webauthn is really easy!

Controversial opinion: If you are given all these options and you cannot/refuse to use them, you shouldn't manage your insurrance trough the web. Either you are wholly computer-illiterate, deeply misinformed or you are not educated enough to use it safely.

Of course, the main issue is that companies only give SMS 2FA as an option, or only one other, like the App method, which forces users without phones to fall back to SMS. Worst part is that especially financial institutions are guilty of this.

Re: Ask HN: I have 176 logins/accounts. How many do you have?

#263

Post by [deleted] »

reaperducer wrote: post #140
whstl wrote: post #100

I'm probably the one with the least. I have 35 in my password manager. I purge the ones I don't need every 2 or 3 months. I even gave away GOG and Steam accounts to friends after years of not playing games. Sometimes I have to send a threatening email to delete some accounts. Currently there's about 2 I'm waiting for an answer. It's gotten worse lately: people just don't delete your account anymore :D. Because of tha…

a barbershop that needs login/password for scheduling haircuts? fuck off If it takes reservations, it's not a barber shop. It's a beauty salon.

[deleted]

Re: Ask HN: I have 176 logins/accounts. How many do you have?

#265

Post by EVa5I7bHFq9mnYK »

Hard to know, I have 20 to 30 Facebook accounts, mostly bought from account seller sites, becaused I wanted to see various Facebook pages not accessible to outsiders. Not sure how many of these passwords still work.

My oldest working account is probably 1996's ICQ.

Re: Ask HN: I have 176 logins/accounts. How many do you have?

#267

Post by 2-718-281-828 »

altacc wrote: post #257

About 500, after a clear up. I'm currently shopping around for a new password manager but that's proving to be a frustrating search. Bitwarden scrambled my master password so that I lost access, not just once but twice (password was saved in another password manager, so definitely correct). Lastpass has 'issues'. Dashlane web app only gives me an error message. 1Password feels clunky but may be what I end up going wi…

look no further ... pwsafe.org

Re: Ask HN: I have 176 logins/accounts. How many do you have?

#268

Post by usrusr »

bityard wrote: post #157
lexandstuff wrote: post #131

Earlier quoted context omitted.

I'm confused about what you're fucking off. Would you prefer to schedule haircuts via a call or an anonymous online form? Being able to schedule appointments online is one of the big wins of modern life imo: it beats waiting around on hold and laboriously explaining to the receptionist how to spell my last name.

Restaurants get the online reservation thing right, usually. With other local small businesses, it's very hit or miss and you are better off calling unless you know for sure their online system actually works. I made an optometrist appointment online recently. Their online calendar showed which dates and times were available, so I picked the closest one which was still a few weeks out. I got an email immediately afte…

I've seen that sales funnel (selling to the business, not to you) from the other side, integrating some "request appointment" UI where your click supposedly sets some back-office in motion that asks for an appointment with the business that might in fact never had contact with the intermediary before. Then later the sales squad will drop in arguing that all those appointments are revenue that they might lose if they don't become a customer to the full version of appointment tool.

This is not that bad in the beginning (though certainly not good!), the hopeful customer won't be promised anything before the appointment is actually made. If the presentation is sufficiently clear about the appointment hunt not really being over before confirmation it's not that bad. But even when started in a rather benign form, these things can quickly turn nasty, by skimping on the back office and/or "streamlining" the UI into a presentation that isn't clear at all about nothing being committed yet. And I'd also imagine that unscrupulous competition might be tempted to fake-register with the service in some zero-cost tier, effectively black-holing all appointment request to let the resulting Google/yelp/whatever zero star reviews ruin their competition. Which points us to the deepest tier of darkness, the appointment service knowingly claiming to have made an appointment when they haven't, betting on more of the fallout hitting the small business than themselves and using that to coerce them into buying the service (essentially a darker form of what yelp was famous for).

Re: Ask HN: I have 176 logins/accounts. How many do you have?

#269

Post by raxxorraxor »

xp84 wrote: post #36
KronisLV wrote: post #29

Around 300 at this point, sans any deleted ones. I don't think I know a single password anymore, since they're all randomized and separate for each site. > Obviously, anything with OAuth is "bundled" into my Google account. Maybe it's just me, but I try to never use centralized identity providers (outside of things that I really don't care about) and use separate e-mail auth whenever possible, across multiple e-mail…

> people getting banned … with no ways of getting in contact with the support This is the most out-of-whack part in my humble opinion. Most of us have a tremendous amount of data and things like auth tokens tied up in Google, and Apple, and due to their scale and the fact that at least for GOOG it’s a “free service,” they’ve set the expectation up that “support” should be limited to searching an FAQ, and also that an…

I still think this is a bad idea. I never use oauth logins and believe the convenience isn't worth the dependence and security risk at all.

Exception are my work accounts. Here I am public anyway, so what gives. I think there still is a huge risk of industrial espionage, but anyway...

Re: Ask HN: I have 176 logins/accounts. How many do you have?

#270

Post by npteljes »

I have 573 entries in my KeePassXC. I have several very important passwords that are not in there, like my work password and of course the keepass safe password. Auth is indeed insane. Because of this insane power, I don't trust any ID provider with my logins, not Google, nor any other third party, so I log in with a password everywhere.

As for maintenance, I don't think it's much, and I'm not even using the browser integration (again, for security). It's a few simple clicks to create a new entry, and the default auto-fill (username, tab, password, enter) works on most of the websites.

Post reply on HN