Right up there I'd put:
Don't force people to use E-mail addresses as user IDs. It's a terrible idea for security and it's just straight-up dumb. Talk about amateur hour.
Don't force people to use E-mail addresses as user IDs. It's a terrible idea for security and it's just straight-up dumb. Talk about amateur hour.
If every website did this, no one will ever sign up.
Not to mention, I said ANY string; that could be your E-mail address if you want it to be.
Finally, your assertion about "any Web site that did this" is absurd, since a huge number of (probably even most) forums are powered by software that requires you to specify a user ID that doesn't have to be an E-mail address.
I also said that users COULD use their E-mail addresses if they wanted to. An E-mail address is a string, and I said "any string." I mean you yourself pointed out, "On Steam, people login with their username or email address"
So what's the problem?
Because they already have to remember their email address for other things, like to give it to people, to log into LinkedIn, etc.
Now you want to give them another piece of information that they must remember in order to log in?
You do realize that millions of Web sites, including every financial institution's (that I've ever seen, anyway) let (or require) users set up legitimate IDs that are separate from their E-mail addresses, right? Or is this news to you?
Millions of forums based on PHPBB alone use proper user IDs instead of forcing users to use an E-mail address. That's just one open-source forum system: https://www.phpbb.com/community/viewtopic.php?t=546501
If you want more info on why E-mail addresses are a stupid user ID: https://goldmanosi.blogspot.com/2012/06/forcing-people-to-us...
And then yes, there is no validation that someone named „@verge“ is really from TheVerge – simply because there is no such name, and users just need to tell people that 3728348 is their handle. Like a phone number. Unique, easy, fair.