Hacker News Reader

Comment by arkh | Hacker News Reader

> Just because you have no use for it, doesn't mean nobody has.

Lot of websites you'll visit once per decade (maybe) still ask for account. Or things like the software you get to manage your gaming peripherals which nowadays all ask for an account for no reason.

Those accounts getting hacked? I don't care. So they all get a shitty birthday password if they accept it. If they prefer to use some stupid "X uppercase, Y lowercase, Z numbers, some special characters" I'll make a new account next time because I'm not using a real email. Or just stop there.

View on HN

Same thing for example for public tv broadcast streams. Often they want you to create an account with an email to watch streams, for totally zéro use for you but they hope to be able to target you with ad and co.

Same thing, I create a random account with random creds each time I want to use it. And there will be zero impact for me if it leaks...

That is your perspective. Not that of the site owner, or the internet at large, victim to any abuse somebody unkind can unleash.

Security is a bit like traffic. If you're alone in the world, you do you. But you are not alone, you have a responsibility to others, be it passers by, fellow travellers or those loved ones depending on you making it back alive.

If a new account has that much power to abuse the system, then your problem is not the 2FA security. They don't need to crack your account, a bad actor could just create a new account for themselves.

Sounds like you’re describing a situation where every user must have a secure account in order avoid a problem. In that case, it’s not just the technically-minded folks here who need to have secure passwords. The site itself should enforce password security, not individuals.

> That is your perspective. Not that of the site owner, or the internet at large, victim to any abuse somebody unkind can unleash.

Frankly, in a lot of these cases the site owner (e.g. Razer) has already decided to put their interest ahead of mine by requiring accounts to e.g. configure peripherals locally so they have can harvest sign ups for their marketing lists or tell investors they have XXX MAUs. I don't care if my password choice inconveniences them in turn.

Reply on news.ycombinator.com