Hacker News Reader

Comment by sp332 | Hacker News Reader

But any emails sent to my old address would be read by the new owner.

I can give a real example of this that happened to me. I have a Steam account. Many years ago I created it using a Hotmail email account. I never used Steam for a couple of years. One day last fall I decided I wanted to do a little gaming, but I could not remember my account. I did the password reset but it never came through. I tried logging into my old Hotmail account, but they said it didn't exist. I re-created it, resubmitted the Steam password recovery form, and recovered my account _with_ saved credit card information.

Thanks for sharing. This is terrifying and it's the reason releasing the email addresses is a horrible idea.

The web runs on the assumption that you have access to an email address and you'll never lose control of it. Ignoring that assumption and opening up your old users to identity theft just because you want to reissue short usernames that will again be squatted on is kind of crappy.

Was your credit card still valid? Most cards aren't good for longer than 4 years, and chances are you had a few years on it when you signed up for Steam.

Same if you move physical locations and your mail forwarding expires. If you haven't logged in for 12 months, can it really be that important?

You changed addresses but forgot to update your bank to the new email address. Then someone resets the password using the new one and empties your bank account. Passwords are tied to email addresses unfortunately.

Exactly, this is analogous to your home address. Bad things can happen if people send mail to an address you don't live at anymore; it comes with the territory. I think a year is actually a bit short, but there should absolutely be some expiration date on accounts like email addresses. Five years seems like it would be more appropriate. Five years on the internet is an eternity.

Not sure about the home address analogy. I don't know about you, but I don't open mail that doesn't have my name on it, even if it has my address.

Maybe I'm just being naive, but it seems to me that someone getting a letter addressed to you is much less of an issue than someone getting your email.

The risk regarding email isn't that someone gets it, it's that someone dastardly gets it. I think that same exact risk applies in real life.

Reply on news.ycombinator.com