Hacker News new | ask | show | jobs
by 486sx33 638 days ago
This is bad for anyone who recycles passwords. Most everyone I guess.

I’m sure they aren’t the only company to do so

I don’t think having an online account with your utility provider is required or smart. Good old postal mail is the way.

2 comments

Paying by checks through the mail is so annoying and difficult to stay on top of. I can't understand how you would prefer that approach in general -- is there some strategy here that I'm missing? Or is it that you open mail always immediately when you receive it, and minimize changes in address / vacations?

My strategy is to have a "disposable" password that you use for low-value purposes, like paying utilities. I assume this password is public knowledge, and accept that if somebody has it they can do such nefarious things as... pay my utilities bill.

My guess as to what OP means: postal mail, as in, mail me my bill. And then pay electronically through your bank, not the company’s online portal. At least that’s the way I do it.
Nice things about checks:

  - not subject to the annoying daily / monthly limits of Interac eTransfers, EFT's, etc.
  - easy to hand to someone, especially where there's no internet
  - generally no extra fees
  - for B2B, pretty much everyone accepts them
  - post-dating (one tactic toward your question of how to deal with regular payments, eg. rent)
  - in the US, a picture of one (meeting certain criteria) has the same legal status as the original
  - float (not nice at all for you, but a not-insignificant revenue stream for your bank/insurance company/etc)
They also fostered a whole soup of fraud prevention practices that is mostly irrelevant to electronic payments yet still seems to pervade and add friction to them.
Do you really want to bank on your utility to have their shit figured out so you don't pay the utility bill for your whole town? Even if you do entirely get it resolved, that seems like extra hassle when you could just... use a password manager.
That’s fair, a password manager would be a good (and likely better) alternative. The only reasons I haven’t made the switch:

1. Even password managers are unreliable, with many popular ones getting hacked in the last 10 years. And I don’t like the idea of storing _all_ my passwords with a single service which may be hacked. I suppose I could just store a subset of my passwords, but that eliminates a lot of the convenience

2. I still find password managers somewhat annoying to use in general. Copy-pasting is disabled on many login forms, so I often would have to manually type an unfamiliar password. And when I’m not using my personal laptop I have to “log in twice” to complete a single intended login - this has historically been fairly common for me, though maybe less common recently

There is always discussion about people re-using passwords. Why don't more people use something not cloud based like KeePass to keep track of that? I do not get it.