Hacker News Reader

Comment by bink | Hacker News Reader

I'm sure they're not really overly concerned about security, but email addresses get logged everywhere on the Internet. Accounts would be pretty easy to hijack. Maybe that makes it more fun though.

View on HN

I don't think they take security any less seriously than most social networks. If you're worried the sending/receiving servers have access to the email address, then it seems you would have to be equally concerned account recovery via email considering most email is not encrypted.

The target email address basically includes a secret that allows you to post by sending an email to it. It's not the same thing as clicking on an email you receive to reset a password. I can't reset your password just by knowing the email address associated with your Facebook account. I'd have to intercept the password reset email.

I personally love low-security social networks. I consider HN to qualify (as you just need a username and password, no email verification).

Small social networks can get away with it b/c they aren't big enough targets for abusers.

Account security is a bigger concern for the network than it is for the user. If someone steals my HN account, I won't really care (it's around my 5th account anyway). But if the hacker uses my account's reputation to evade spam filters, that becomes an issue for HN.

Most reputation scores are ephemeral, to cover the case you mentioned. I have never heard of a website that gives old accounts free passes to do whatever they way. They may have fewer restrictions initially, but if abuse is detected, they will still ban the account.

Not exactly social media, but when Instapaper came out they only used usernames, no password. I think the idea was that no one would care enough to delete your read it later list, and it wasn’t big enough to draw much attention. I remember it being like this for quite a long time.

Your comment makes me wonder...what is HN's spam volume?

I never see any.

I read the /new queue a lot and flag a lot of spam. There’s probably dozens of us.

Thanks.

HN audience is much more likely to use complex passwords, that are not reused elsewhere.

So the overall security level is probably still higher than elsewhere with 2FA, etc.

I have data that says otherwise.

Maybe a publishing address is locked to a sender address after the first post, so you'd need to also hijack the sender account

Reply on news.ycombinator.com