Hacker News Reader

Comment by bryanh | Hacker News Reader

Curious to see if others have their own suggestions. We've noticed that if we not pretty vigilant about it, the creep factor sets in and suddenly there are lots of weird things happening around micro-features.

View on HN

Since most of these seem to be about user accounts, I'll add: Don't require a user to have an account unless it's actually necessary for the feature.

Also, although I understand many folks have philosophical problems with this, you should support one-click log in with at least one of Facebook, Google, or Twitter. I almost certainly do not want to make a password for your site.

On a related, but opposite note, don't make one-click log-ins the only option. I almost assuredly don't want to add another point of access to my Facebook/Twitter/Google data, and would rather manage my Lastpass account than monitor my app permissions across several services.

A bizarre one that affects Microsoft DreamSpark, (and probably others) is that they silently escape characters in your password. Apparently they do this using two different methods depending on whether you're logging in or changing your password, so if it gets escaped one way, it might not be escaped the other way, and then you can't log in.

Consequently I don't think you can include brackets in your password if you want it to work. The front-end apparently isn't aware of this limitation, so they'll happily let you do it.

Code re-use: a very good idea.

Reply on news.ycombinator.com