To be honest, the first one that comes to mind is HN. There is zero consequence if someone was to get a hold of my credentials here — I don't care about the score and I can still recover the bookmarks.

What if the person that takes over the account posts messages that arouse the interest of authorities? Your IP addresses and other info are associated with the account.

I think this is a pseudo-problem in pretty much any country except for, perhaps, totalitarian regimes or similar. If any large body would take interest in the account seriously enough to get the associated IP, they would also automatically get the new account holder's IP and the clear correlation.

Are you posting on Hacker News from your own IP address?!?! :-O

> 2. What kinds of websites that require a sign-in are actually low-consequence?

It's usually not a function of the site, but a function of the site and the user. pg would probably care more about his HN account than user051783254. That said, some sites where I expect the majority of users (mostly the non-paying ones, but perhaps even the paying ones depending on the payment mechanism) would probably not care about their accounts being hijacked might include: HN, StackOverflow, CodeProject, AllTrails, Disqus, Last.fm, SlickDeals, etc.

Low-consquence? Typically one-off purchases from random internet vendors; if no saved credit card details, just a way to view past orders. Risk is leakage of more PII, like address.

Forum logins risk reputational damage, but otherwise are reasonably limited. Some people use specialist forums to ask one-off questions, for example.

I had a login at a game website called Shakes & Fidget years ago. The site itself is low-consequence. I wouldn't care if someone hacked my login. Another example is when I'm just trying some service and don't expect to use it ever again.

What would worry me is if people hack the login for a low-consequence site and then figure out that those login credentials for this user are the same everywhere: at their bank, Amazon, etc. Personally, I use different passwords at every single website, but at low-consequence websites I sometimes use less secure ones. I don't see how this is a problem (for me).

I understand why low-consequence sites do not implement schemes to force users to use stronger passwords, though. Howls of outrage, lost users, and attempts to get around it, as charDiversity says: https://news.ycombinator.com/item?id=16975773

2. all sites/forums/whatever that require you to login to see a link, download stuff ... you get the idea.

Or probably: sites that don't involve money.

What kinds of website would require a throwaway email address?