Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

What do people think about outsourcing your authentication to someone else?

Full Disclosure: I'm currently working on a brandable authentication host (http://www.authic.com) that will outsource the pain of storing your password hashes securly and provide your web app with slick a user account UX.



My own personal attitude is that I'd prefer having independent, unlinked accounts among various service providers, for which I use long, randomly generated passwords.

My risk from any given service is relatively low. My passwords are strong enough (trillions to quintillions of years brute-forcing time per the online calculator's I've checked -- with similarly constructed passwords, not my actual ones, natch) that risk of bruting a hashed key is low, and I don't re-use passwords. For services that store passwords in cleartext (still fairly common practice on mailing lists), no big loss either.


I'm offering my users Browserid and/or Facebook in order to login. Works great and passwords are definitely something I'd rather not deal with. Also saves me from having to implement all sorts of stuff like forgot password, forgot username, etc.


Do you also offer your own login forms?


Nope. Feel free to play around and try it yourself. I think the experience is not 100% perfect but is pretty darn good. That said, I'm always open to constructive feedback. www.voo.st


Looks nice. My biggest feedback is that there is no "Join now" link/button, just a login. I presume that if you try and login without an account it will go ahead and sign you up, but it is not obvious.

Also the line "All events on Voost are managed by an organization" - I'm not sure what that means, what is an organisation? Is that me?


Great feedback, thanks. The button is 'sign in' since we don't really need the concept of login. Adding another button seems more confusing, what would it do?

As for the text, sure, we can work on clarifying that more.


Having two buttons doing the same thing wouldn't necessaryily be confusing. People would probably not notice.

Or how about change the wording to "sign in/up".


We all do it daily with Facebook et al delegated authentications.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: