Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

By centralizing authentication, you make that central provider an even bigger target and you risk losing access to other services as you lose your main account (Google is known to sometimes terminate accounts with no way of recurse).

Finally, when that central provider gets hacked, all your dependent services are now also compromised.

And as we know from the CloudFlare story over the weekend, not even Google with their 2 factor authentication is devoid of issues.

No. Centralizing your login to one third-party as as bad as the current practice of reusing your password for every service you have an account with. The only way that is reasonably safe is to use different random credentials for every service and store these credentials somewhere under your (and only your) control (i.e. a password manager or a piece of paper)



Browserid is not a centralized authentication protocol. Although currently all implementations I know of rely on browserid.org, this is not required by its design.

There's also the fully decentralized openid, you know. I'd 100% rather be able to use openid for sites like Linkedin and this one than rely on every site implementing sane password management.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: