Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

HN create account removed from login page

news.ycombinator.com

Post reply on HN
Print view View original

41–50 of 69 posts

Re: HN create account removed from login page

#41

Post by cookingrobot »

roel_v wrote: post #9
temp2012 wrote: post #5

Also, OpenID has been removed. How do I login with my Google account?

You can't anymore. There was a post a few months ago that you should set a password on the site itself to be able to continue to log on in the future (future being now, since a couple of days or maybe even weeks already).

I'm curious why they removed openid. This is relevant to a project I'm working on.. are there good reasons not to offer that as a sign-in option?

What are considered current "best practices" in building an account system?

Re: HN create account removed from login page

#42

Post by biot »

Hannan wrote: post #39
bravura wrote: post #36

Perhaps related.... The past few days I've gotten several emails from 'info@ycombinator.com' telling me that I have a new password. (I received several new passwords in the past few days.) The header seems to indicate that the message was actually sent from news.ycombinator.com. Are these legit? Why am I receiving them? Has anyone else got one? I've ignored them for now.

If you try to log in with a valid username, but no password, you'll get a link to email yourself a newly generated password. The text of the email is: New Hacker News pw: So someone probably thinks they have your username and are wondering why they can't remember the password or receive an new password. Far less likely is that someone could be trying to discover/exploit a timing attack on the forgotten password gener…

If HN replaces your password with a random one when requesting a forgot password, that's a great way to denial of service someone -- just keep requesting new passwords every 10 seconds and they'll never be able to login.

The better approach is to generate a secure password change link with an expiring change request token. Upon clicking the link, the token is validated and you're allowed to set a new password (or have one randomly generated). However, until the link is clicked and the token validated your old password should remain the same.

Re: HN create account removed from login page

#43

Post by Splines »

Hannan wrote: post #39
bravura wrote: post #36

Perhaps related.... The past few days I've gotten several emails from 'info@ycombinator.com' telling me that I have a new password. (I received several new passwords in the past few days.) The header seems to indicate that the message was actually sent from news.ycombinator.com. Are these legit? Why am I receiving them? Has anyone else got one? I've ignored them for now.

If you try to log in with a valid username, but no password, you'll get a link to email yourself a newly generated password. The text of the email is: New Hacker News pw: So someone probably thinks they have your username and are wondering why they can't remember the password or receive an new password. Far less likely is that someone could be trying to discover/exploit a timing attack on the forgotten password gener…

> Far less likely is that someone could be trying to discover/exploit a timing attack on the forgotten password generation algorithm.

Didn't somebody do that already?

Re: HN create account removed from login page

#44

Post by jsprinkles »

thaumaturgy wrote: post #8

pg (or possibly another admin these days) will remove the create-account functionality if HN suddenly becomes very popular, as with the LinkedIn thread. I'm trying to find one of his comments where he mentions this, but there are 8,511 to wade through, and the obvious searches haven't found it yet. edit: I may have misremembered; the first reference I've found was http://news.ycombinator.com/item?id=3481174 , but I'm…

It was gone last night, before the LinkedIn news. I know because my session happened to expire and I noticed. At least 12 hours ago, possibly more.

Re: HN create account removed from login page

#45

Post by jacktoole1 »

cookingrobot wrote: post #41
roel_v wrote: post #9

Earlier quoted context omitted.

You can't anymore. There was a post a few months ago that you should set a password on the site itself to be able to continue to log on in the future (future being now, since a couple of days or maybe even weeks already).

I'm curious why they removed openid. This is relevant to a project I'm working on.. are there good reasons not to offer that as a sign-in option? What are considered current "best practices" in building an account system?

Here's the initial thread: http://news.ycombinator.com/item?id=3618082

My impression was it was more a feature of clickpass's implementation being outdated and requiring maintenance than OpenID not being useful, although there was sentiment that OpenID never gained enough traction and isn't the future anymore.

Re: HN create account removed from login page

#46

Post by eli »

Splines wrote: post #43
Hannan wrote: post #39

Earlier quoted context omitted.

If you try to log in with a valid username, but no password, you'll get a link to email yourself a newly generated password. The text of the email is: New Hacker News pw: So someone probably thinks they have your username and are wondering why they can't remember the password or receive an new password. Far less likely is that someone could be trying to discover/exploit a timing attack on the forgotten password gener…

> Far less likely is that someone could be trying to discover/exploit a timing attack on the forgotten password generation algorithm. Didn't somebody do that already?

It was the session cookie key not the password, and it wasn't really a timing attack in the sense the parent means.

But yeah http://news.ycombinator.com/item?id=639976

Re: HN create account removed from login page

#47

Post by BadLogInMyAss »

thaumaturgy wrote: post #8

pg (or possibly another admin these days) will remove the create-account functionality if HN suddenly becomes very popular, as with the LinkedIn thread. I'm trying to find one of his comments where he mentions this, but there are 8,511 to wade through, and the obvious searches haven't found it yet. edit: I may have misremembered; the first reference I've found was http://news.ycombinator.com/item?id=3481174 , but I'm…

I wish they'd fix the log-in system in general. It continually reports "bad login" for no reason, rendering your ID permanently useless because there's A: nothing wrong with the credentials you entered and B: no way to reset them.  And yes, I have an E-mail address specified.

And the behavior is totally unpredictable.  Once, after several attempts, a message magically appeared about sending a new password... but because the log-in credentials were "bad" and in fact cleared out, the system didn't know where to send any such E-mail.  Yet it claimed to do so.  Surprise, surprise: That E-mail never arrived.

So we wind up having to create a new user ID on every machine or every time a cookie expires.  It's pathetic.

Re: HN create account removed from login page

#48

Post by BadLogInMyAss »

koeselitz wrote: post #28
BryanB55 wrote: post #27

Earlier quoted context omitted.

Its funny how defensive HN readers are. I love HN and its content but I'm just wondering why there isnt a forgot password link? Seriously...?

I wondered that for a while, too. But there is a forgot password link, actually. You just have to enter your username and leave the password field blank, and then hit "login." You'll then be presented with a link to get a newly-generated password in an email.

That "design" seriously undermines the credibility of a tech site.

Re: HN create account removed from login page

#50

Post by alter8 »

at-fates-hands wrote: post #32
azinman2 wrote: post #11

Earlier quoted context omitted.

Unless you can't because that box isn't there to do a password reset. Which, btw, is really frustrating as I just had to create a second account to write this. I used to use OpenID and now I can't login to my old account at all.

I had the same experience. Pretty frustrating when you don't know what's going on (I'm a pretty regular visitor and missed the OpenID thread) and then want to comment on something and BAM! You have to create a new account in order to do so. Maybe a separate page for changes to this site? That way, if someone misses it on the front page, they don't get hung out to dry. *updated for clarity

I'm surprised that http://ycombinator.com/newsnews.html has not been updated on this important topic. How much would it help, though? There should be an RSS of it.
Post reply on HN