Hacker News Reader

Comment by dfxm12 | Hacker News Reader

You used to be able to create a reddit account without an email address. If all they can get is a username and password, by and large, who cares? Just create another account and you're on your way. It's way less likely hackers will figure out your creds on other sites if they don't have an email address to act as a key.

Why require email for dumb social media sites? You can talk about password recovery, but emails aren't necessarily required for that, and it could be something to opt in to. It seems like email is required to make data collection, tracking and advertising easier. It sucks that all this creepy data collection is not only an annoyance, but also makes us less secure.

View on HN

Reddit doesn't require an email. They use dark patterns to make it look like you do, but anywhere it asks for an email in signup can be left blank.

I think the mods can see if your account has a verified email attached to it though? At least it seems like subs can choose to not let unverified accounts post.

Yea, you cannot post in /r/news for instance without a verified e-mail. Automod will remove your posts/comments.

I don't know what they think they are accomplishing since burner e-mails are trivial, but perhaps it gives a semblance of doing something.

Anyone can see if an account is email verified. It shows up as a "trophy" in the account info page.

Doesn’t work for me. The Continue button is only enabled once you enter an email address. Furthermore, activating 2FA requires a verified email address.

Edit: It works when using the right URL, see https://news.ycombinator.com/item?id=34742134 below.

It only works on the desktop site. Did you try on mobile?

It works when manually going to https://www.reddit.com/account/register/ (both on mobile and desktop), but it doesn’t work when following the Log In / Sign Up links from the Reddit page, which have additional URL parameters attached. Maybe this is also an A/B testing situation, as the additional parameters have “experimental” in their name.

I might be thinking of old.reddit.com. I know that the mobile version requires an email there but the desktop version asks for it, but if you click continue, it doesn't check if you've entered one.

That experimental part is interesting.

My Reddit account got hacked a few years ago because I created a Reddit account using a throwaway password, since I didn't care much about Reddit when I started. The hacker started using it to promote crypto.

I was able to get the old account disabled, but couldn't get it back because I couldn't prove I'd ever owned it. So I created a new account, and it wasn't a big deal, but I was annoyed that I lost my preferred username. Fortunately I'm not a moderator for any subreddits.

Don't get the privacy concerns. I'm totally fine if people know what I post on Reddit. It's public. I wouldn't want any friends to get confused by private messages sent as me, though.

People who don't care about losing their account probably aren't doing anything they care about with it, and that's okay, but it's not everyone.

> Don't get the privacy concerns. I'm totally fine if people know what I post on Reddit.

Good for you. But for others, pseudonimity is a way of protecting themselves in real life. There are people who cannot express their views on certain subjects without inviting scrutiny, or even danger, in their real lives.

> It's public.

There are private subreddits.

Yes, you are right. Let me correct my post: I fully respect the right of some people to post under pseudonyms for well-known security reasons. I don't get why people assume everyone should do that.

I've never used a private subreddit, but I imagine it might be hard to get back in after your account got hacked?

I’m not following, how did a throwaway password get you hacked? Did they use a common password leak list to guess via bruteforcing? Does Reddit not rate limit login attempts?

I used the same throwaway password on a variety of sites I didn't care much about and the password got on a list.

I don't do that anymore.

> If all they can get is a username and password, by and large, who cares? Just create another account and you're on your way.

Who cares? Those of us who treat subreddits as communities, and as such have built relationships there.

There are legitimate reasons for requiring an email, e.g. increasing the difficult of making bots and for banned people to make a new account.

Phone verification raises account creation costs to at least 20-30 cents an account (assuming you ban VOIP and only take first world countries, can be lower otherwise), email verification if you still allow yandex rambler outlook hotmail addresses raises it to a cent at max.

Take my parent's complaint and replace email with phone and the complaint gets worse since the privacy concerns are even greater.

Most email services now demand SMS verification to sign up for them now as well.

Reply on news.ycombinator.com