Hacker News Reader

Comment by DidYaWipe | Hacker News Reader

This is a good reminder that forcing people to use an E-mail address as a user ID is a stupid and dangerous policy.

Voted down by amateurs who set their Web apps up this way. Killing the messenger won't secure your users' credentials.

The email acts as an implicit second factor. But in any case security is a losing battle anyway. We should assume everything is compromised in the long term

As if users wouldn't just use the same username everywhere. So now besides telling them to use different passwords for every website, you also need to tell them to use different usernames.

But you can't use the same username everywhere, for example doing a Google search of my username shows accounts on other sites that are not related to me. Doing a search for your username suggests that it is also likely taken on numerous other sites, including a rock-band named FoxyGen that I'm fairly confident you are not a member of.

Well, yeah, the same way you can't use the same password because some websites have weird rules about password length and characters. Doesn't change the fact that you will be able to use the same username in MOST websites, given you don't have a super common username. The only solution to this problem is a password manager, which most people won't adopt anyway.

So what? At worst, it's no worse. But by default, it's already way better.

Why? Because all of our E-mail addresses are on thousands of spammers' lists. So if you hammer that list with a dictionary of popular passwords, you're going to get a bunch of compromised accounts right there.

But even worse: When you force non-tech-savvy people to use their E-mail address as their ID, many are going to think they need to use their E-mail password as well. So now if one poorly-run site suffers a data breach, all of its users' E-mail addresses AND passwords are out there. Identity theft ahoy.

Not to mention the loss of people's accounts when they change E-mail addresses; When Apple started requiring that Apple IDs be E-mail addresses, it created a massive problem of people having purchases scattered across multiple accounts because they'd create a new one when their E-mail address changed.

After the outcry, Apple huffily declared that it wasn't going to let people consolidate their accounts.

But back to the point: Allowing people to create a proper user ID as free-form text doesn't preclude them from using their E-mail address if they insist on doing so. But they should be encouraged not to.

Reply on news.ycombinator.com