Hacker News Reader

Comment by nine_k | Hacker News Reader

If registering at yet another site (forum, online store, government site, etc) and remembering the password when you get back to it 2-3 month after is not a problem for you, I admire your memory. Or maybe you're not visiting these types of sites as much as I do.

View on HN

Or perhaps he is just doing what everybody _really_ does, which is to use the same username and password for every random site on the net and hope like hell they are not storing passwords in plantext.

A hope, which has been dashed time and time again by bitter reality. It seems the only people lazier about password security than the actual end users, is the site owners ...

But that doesn't work, because every site has slightly different rules about what constitutes a valid password...

Another solution to this is a password manager, eg Keepass. It still centralizes your identity under one roof, in the encrypted DB, but only locally.

But the overhead is much larger and let's be honest, this solution is only used by a tiny minority of (mostly tech) users. Mozilla Persona could be used by everybody because for the end user it is exactly as complex/easy as it is currently or even easier.

Password managers are necessary, but they're not enough. So long as there's an underlying password for every damn site you visit, then every damn site still has to store passwords securely and you have to maintain things when that site gets breached. Not to mention the stability of that password. If it gets sniffed once, it's possibly game over for months. If a Persona assertion gets sniffed in transit, it's only good for a few minutes in time.

Reply on news.ycombinator.com