Hacker News new | ask | show | jobs
by Pxtl 3294 days ago
I was with you until logins. I'm tired of creating accounts and managing umpteen million passwords.
3 comments

I only know two passwords: one for my password manager and one to unlock my computer.
But you're still "managing umpteen million passwords", hence the name password manager.
That makes no sense. You use a password manager so you don't need to manage the passwords. If you don't like the concept of having passwords at all then use a stateless, hash-based password generator instead.
How does one integrate that with Facebook or Google or Nameasite?
A browser extension could be made pretty easily. If you have a terminal open, do `echo mymasterpassword facebook.com | shasum -a 256 | pbcopy`.
What's the alternative? To authenticate against our FB account? I'd much rather have a distributed system than to be forced to maintain a FB account just to login.
Persona seemed like a pretty good system, until it was shut down. I don't like single-sign-on systems in general, but having it managed by the Mozilla foundation seemed a lot safer than relying on Google/Facebook. I think their original long term plan was to transition users away from their single-sign-on service as browser support for the features they needed got better.

The only thing that bothered me about the general design is that it used email addresses as identification tokens, and for the site I was making I didn't even want that much personal information from my users.

How about indieauth[0]?

Indieauth lets you authenticate to websites based on your control of a website you specify (via rel=me links).

[0]: https://indieauth.com/

I haven't fully read your link yet, but wasn't that the point of the original opened spec too?
Yes? But indieauth does not require you to personally run an auth server, which makes it easier to adopt. Basically it will search through different online identities that you list on your home page and letting you choose any of their OAuth services.
Neither did OpenID, you would just list your auth server in a special meta tag. IndieAuth even seems to support acting as your OpenID server, see https://indieauth.com/openid .
"I'm tired of creating accounts and managing umpteen million passwords."

That's your choice. You can use the same credentials for all accounts you create and manage the entire mass as one. It's a bad practice, I know, but it's still a solution.

> It's a bad practice

That's the understatement of the century.

Sure, "not recommended", but works fine for 99% of people 100% of the time.
It's such a bad practice that it is not a solution.