Hacker News Reader

With passwords you will get even higher probability if you just try 100 most popular passwords allowed by the service on hundreds of thousands of users.

Try making password creation too difficult and now password reset will be the default authentication for a lot of users anyway.

View on HN

The 100 most popular passwords should already be blacklisted during registration, so it wouldn't be possible to set them as your password.

I have nothing against password-reset-as-authentication aka "magic links", when done properly. And by properly I mean not using an ultra-low entropy auth code, like the parent is proposing (6 decimal digits, aka 20 bits of entropy).

Reply on news.ycombinator.com