Hacker News Reader

You are only giving the site your JID (username) not password and it verifies that you control the JID so you really are jepz@example.com

Indeed, it should be comparable to authentication by token or link sent via email.