Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: I have 176 logins/accounts. How many do you have?

news.ycombinator.com

Post reply on HN
Print view View original

271–280 of 300 posts

Re: Ask HN: I have 176 logins/accounts. How many do you have?

#271

Post by lwhi »

tppiotrowski wrote: post #120
lwhi wrote: post #90

Earlier quoted context omitted.

It's not pragmatic, it's dangerous. Sooner or later someone could take control of one of the accounts you don't care about and use in a way you don't expect to gain control of things you do care about.

> use in a way you don't expect to gain control of things you do care about An example would really drive your point home. Can you provide one that people would deem "dangerous"? Edit: ccooffee just mentioned in the thread that you could be de-anonymized by reusing the same password. Is this what you mean? There's a spectrum of comfort with privacy so maybe that's the source of the disagreement between whether it is…

Socially engineered hacks are also a danger.

You might not care about what's contained in a certain online account, but there could be utility in taking control.

Re: Ask HN: I have 176 logins/accounts. How many do you have?

#274

Post by hammyhavoc »

slt2021 wrote: post #228
akira2501 wrote: post #58

If I need to login to your site less than once or twice a year, "Forgot my password" is my password manager. Personally, I feel that the utility of me working to keep and maintain that information in a database for high availability is essentially zero. As a result, I store very few accounts overall and checking out as "guest" hasn't been a problem of any sort. There's like 10 critical things that I feel the need to…

problem is that sometimes these websites takes forever to send password recovery email. especially if they use some sort of cheap cloud service to send email/sms, then it can take 15-20 minutes to receive password reset link have you not encountered cases like these?

The problem usually isn't that it's a cheap cloud service, the problem is usually that their cron task is hourly, or more commonly, their scheduled tasks depend on a non-cached page of their website being hit (how people generally mismanage WordPress), but traffic is of course inconsistent.

Re: Ask HN: I have 176 logins/accounts. How many do you have?

#275

Post by projektfu »

willtemperley wrote: post #93
crooked-v wrote: post #79

The most infuriating auth-related thing for me is the companies that insist on doing phone-based 2FA. I'm inextricably linked to my specific phone number at this point in a way that previously was only an issue with my email address.

This. SMS 2FA has been considered insecure by NIST since 2016 [1] and it's a major pain when travelling and swapping sim cards. [1] https://www.theregister.com/2016/07/24/nist_says_sms_no_good...

This is a beautiful catch-22 because when you can't use your SIM is also when they decide your location is too different and you must be reauthorized. The same for anti-fraud text messages, which are nice when you're home but useless when you're out of country.

Why can't I set up an Authenticator again?

Re: Ask HN: I have 176 logins/accounts. How many do you have?

#277

Post by JohnFen »

powvans wrote: post #149
a2128 wrote: post #128

Earlier quoted context omitted.

For websites I really don't care about, I just get a disposable email on dropmail, and copy paste the email address to both the email and password fields to save time. Surprisingly, some websites check this and won't allow you to set your password to your email, but removing the last character or adding a 1 at the end works around it.

Why even go to that much trouble? If it’s truly a throwaway I just use an email address like shitsinthewoods@mailinator.com, grab what I need, and go on with my life. If I ever happen to need to login again, I’ll just send a password reset to the mailinator address and once again carry on with life.

There are a lot of services that disallow email addresses to services like mailinator. That's why I stopped using them, and instead, I have a special "garbage" address on my mailserver.

Re: Ask HN: I have 176 logins/accounts. How many do you have?

#278

Post by i2cmaster »

1) Avoid making accounts in the first place. You almost never actually need one.

2) Recognize that for nearly all sites keeping your account secure is more their problem because they're trying to fight spam than it is your problem.

I think I have about five logins that actually matter and the rest maybe they work or maybe I have to ask for a password reset/new account when I use the service.

Re: Ask HN: I have 176 logins/accounts. How many do you have?

#279

Post by JohnFen »

Cannabat wrote: post #151
cheeze wrote: post #114

Earlier quoted context omitted.

I just use a crappy password. It's been leaked before. I don't care. If someone wants to take over my last.fm account that I haven't used in 3 years, sure go for it. The important accounts get a randomly generated password stored in my password manager. And the really important accounts only have half the password saved, I manually fill in the other half.

I guess that's kinda fine, but there are at least two reasons to not do this: - Access to any of your accounts could make impersonation easier. You might not be the one who suffers from whatever they do. Or if they can assemble enough PII, you might unexpectedly have a line of credit taken out on your name. - Many websites use some form of federated login, or a crossover kinda situation where you have a username/pass…

> Many websites use some form of federated login

This one's easy. Don't use federated logins for anything. They're a bad idea.

Post reply on HN