Hacker News Reader

Comment by HeyLaughingBoy | Hacker News Reader

Same reason you don't secure your front door with an electronic time lock, armed guards and dogs on patrol: it's not that much of a threat.

In the very unlikely event that my HN password gets sniffed, I'll need to change my username or ask for a password reset. Worst case is someone posts a few derogatory comments under my name. I'll survive! The same password is used on a few other sites where the loss to me would be about the same: not a big deal.

View on HN

A similar analogy, but one with an entirely different outcome could be having a lock on your door or not having one. If you don't have a lock on your door, you'll probably get away with it for a while, but eventually you'll be burgled.

Do burglars wander the streets at night testing doors of random places to see if they're locked? If we put the issue to cars instead of houses, there are a lot of people who would rather have their stereo stolen than have their stereo stolen and window broken. To me most locks are more peace-of-mind security.

I just don't buy that lacking some form of security dooms you to whatever penalties the security may have protected against, if indeed any.

FWIW, burglars do sometimes test doors randomly. This is speaking from experience of being almost-burgled while my door was unlocked.

>Do burglars wander the streets at night testing doors of random places to see if they're locked?

Yes. Criminals are oddly enough generally pretty good at cost-benefit analysis. At least in the short term.

I had my car robbed a few weeks ago, they took a 4 year old GPS and $2 in change.

I still feel wronged (it's a little annoying) but I still don't lock my doors (the amortized cost seems to be about $15/year where I tend to park. It's 99% about the time/money trade-off and 1% about what's morally right.

Comparing implementing SSL/HTTPS to securing your front door with an electronic time lock, armed guards and dogs on patrol is a bit of a stretch. I can do one for pennies on the dollar. The other one is a lot pricier (what with dog food and all).

I am sorry, but these are very poor excuses! If even someone as technology and security aware as you reuses his password on various sites, what are the chances that there will be a few people who are not as aware (but still very interested in entrepreneurship), and they use the same password for banking, email etc? And what's the cost of providing SSL support anyway? Almost nil.

I know people sometimes try too hard to justify PG's actions. But, PG is a big believer in making products and services extremely simple for the users. It is surprising that he would expect users to be careful enough to not use their primary passwords on HN. The only excuse that I can believe is that he simply doesn't have time for it.

and they have HN accounts? Perhaps they will learn from this post, then.

This is exactly my point -- It is bad practice to say, people who don't even know better than using multiple passwords shouldn't even be on our site. Or that they should learn to use multiple passwords. The site should take all the precautions anyway (especially if the precaution is so cheap).

Interesting perspective-- so, when is it appropriate to not offer SSL/HTTPS? Is it generally okay to skip SSL/HTTPS if a site isn't mission critical or financial-focused? I only ask because on Heroku and other platforms, there is a fixed cost to offer SSL (with a custom domain) that over multiple sites could add up.

Reply on news.ycombinator.com