Hacker News Reader

Comment by jayeshsalvi | Hacker News Reader

By not storing them https://medium.com/the-story/signing-in-to-medium-by-email-a...

I forget my passwords all the time so clicking on 'forgot password" is already my primary way to login on many sites I don't use often.

That works as long as the website has this functionality. One day you'll miss it... and end up writing to Bram Moolenaar, explaining why you forgot your password (http://www.vim.org/account/forgot_password.php)

    "explain why you forgot your password"

I don't know why but that made me laugh.

The idea that this is even remotely acceptable in 2016 is astounding.

> Why is it telling me I created a new account instead of logging me into my existing account?

> Email addresses on Medium are case-sensitive.

Wow. Is there ever any possible benefit to this? (Serious question)

The local mailbox portion (bit before the "@") of email addresses is case sensitive.

In practice, most email providers don't actually honor that, and so in practice it's a bad move. It is technically correct though.

Hmmm...right you are. Thanks.

I guess I never thought to look that up. Likely due to the common way being so pervasive.

> The local-part of a mailbox MUST BE treated as case sensitive. [0]

[0] https://www.ietf.org/rfc/rfc2821.txt

As for handling this in the real world, the approach I like best is to store email addresses the way they are entered, but create an index on the lowercase version for lookup and uniqueness checks.

A lot of people don't really know their own email address, then. When based on their name, they might write both with capitalization and without depending on mood...

We lower-case all e-mails in our systems. I'll let you know when we hit a system that actually treats it case-sensitive.

Note that the local mailbox portion MUST BE treated as case sensitive in the context of the SMTP protocol and such, but it is up to the mail host to actually define the semantics of the local part. Non-case sensitive mailboxes is not prohibited anywhere in the spec, what you are referring to is there to prevent the local portion of the address from being changed when passed through a relay.

"the local-part MUST be interpreted and assigned semantics only by the host specified in the domain part of the address."

The only problem I see with that is when people change email addresses (maybe they were using their work email and change jobs).

That's an interesting point indeed. When you are fired from your job, you don't often have the time to connect to all our accounts based on your email address to change it. Just checked their FAQ[1] but this does not seems to be covered. Any clue someone?

[1] at the bottom of this page: https://medium.com/the-story/signing-in-to-medium-by-email-a...

I asked Medium about this. They replied, "if you don't have your Twitter/Facebook account connected to your Medium account, you won't be able to sign in at all. You'll need to contact us to regain access to your account. If you don't want this to happen, please do not use an email address you think you won't be using in the future."

I can't figure what is the Medium process when they are being contacted to regain access to an account.

In a near future, we could have a "Argh I lost my email address" link replacing the now very common "I lost my password". Nevertheless, I have no clue what would be a standard process to recover a lost account because of a lost email address, maybe a SMS based process and personal questions like "what was your first pet name?"

Maybe this isn't practical for some people, but I think it's bad practice to use your work credentials for something you plan to "take with you" when you leave. Best to keep a strict separation of work and personal credentials.

Yes and no. Yes, obviously for your bank account or something that is very personal.

But as an IT manager, you could enforce people from your company to use their work email address for accounts that are directly linked to your company activity. For instance, We use a online tracker[1] for Use cases management. When someone leave the company, it does not have access to its email account. Consequently, he/she would no longer have access to our tracker by not having access to its email address. This could rather convenient scheme.

[1] Pivotal tracker (who requires password to connect).

Don't use your work/school/ISP/whatever email. Period.

What about occasional delays in receiving the login email?

This is really awesome! I am going to use it for my next projects...

So there's no password option? That's horrible, means you can't use it with incognito mode (because you'd have to receive an email each time)

You can use the link in incognito. Why wouldn't you?

Because every time you open the site you'd have to receive an email. vs just letting 1password, browser, etc enter the password.

> That's horrible, means you can't use it with incognito mode

No it doesn't.

This is how Craigslist has done it for more than a decade. You can "make a account" with a username/password if you want but it isn't needed.

No issues with incognito mode.

Reply on news.ycombinator.com