Hacker News new | ask | show | jobs
by _susanoo 2875 days ago
Straight from their privacy policy [0]:

-- Please note: To ensure easy account creation, minimal customer errors, and reduced support inquiries, Instapaper accounts initially do not have passwords. If left without a password, anyone can access your account if they know or guess your username. --

This sounds like a serious security issue if you ask me.

[0] = https://www.instapaper.com/privacy
2 comments
bthdonohue 2875 days ago
Hey there – we started requiring passwords many years ago, but the service originally launched without requiring a password or email address. You can read more about it here: http://blog.instapaper.com/post/2318776738
link
_susanoo 2875 days ago
I'm not sure how requiring a minimum password length of 1 character solves anything. Just tried it out and apparently 'a' is an acceptable password.

The article hammers on accessiblity over security and I think you've taken this too far. A minimum password length of 8 is not a 'strange requirement'.

link
diminoten 2875 days ago
Password requirements don't really protect the business, they protect the user, and if the user isn't interested in protecting their data, why should the company force them to care?
link
wpietri 2875 days ago
Yeah, I just don't see the risk here. I don't keep my old magazines in a safe. They go under the coffee table, and then they go outside to the recycling bin.
link
sjs 2875 days ago
In some countries what you read may be sensitive info for many people.
link
wpietri 2875 days ago
In which case, I'm thinking people in those countries know enough to set a password.
link
scarface74 2875 days ago
I think this was originally done when Marco Arment created Instapaper. He’s been trying to come up with a way to avoid passwords for years.

With Overcast - his podcast player, he also doesn’t require a username or password anymore if you’re just using the iOS apps. You can add a username and password to your account if you need to use the web client. But of course this is more secure. It’s piggybacking off the fact that you are logged into your Apple account (no, the Apple ID that is being used is not your actual email address, it’s a token)

https://marco.org/2018/04/27/overcast42

link