Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

I'm no fan of passwords, but we can do a helluva lot better than that.


Such as? A temporary token through email is a slight inconvenience but I've yet to see a better method.

A different password on each site is unacceptable. Being locked into lastpass and the like is also unacceptable.

BrowserID means I can't use different browsers easily. Pass.

An email/token based solution means 1) Users do not have to go through a tedious registration process. 2) Users do not have to remember a passphrase (or worse, a password), which by the way is the most arrogant thing a site can require of its users. By requiring passwords you are telling your users that you're super-duper important and worthy of the memory space. You're not. 3) Logging in and signing up are now indistinguishable from the user perspective.


>BrowserID means I can't use different browsers easily. Pass.

BrowserID requires a single time email verification for a given browser, nothing precludes you from using it with multiple browsers. By definition, it's easier and less intensive than what you're proposing.

>A different password on each site is unacceptable. Being locked into lastpass and the like is also unacceptable.

I'm not locked into LastPass. There are alternatives and I could hack one together with minimal effort.

The other points you bring up have little to do with authentication and more to do with duplication of (often necessary) profile information. There are other solutions for that include extensions to OpenID and oAuth.




Consider applying for YC's Fall 2026 batch! Applications are open till July 27.

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: