4 ms·

So if someone forgets their login details, they're basically screwed? Because I've used some sites like that, and they're a royal pain whenever something goes

by CM30 11y ago

So if someone forgets their login details, they're basically screwed? Because I've used some sites like that, and they're a royal pain whenever something goes wrong. For example, TV Tropes didn't used to have a password reset, so every time something went wrong, you'd pretty much have to either register a new account or bug someone on the forums about it. Same with another site I was on, except the usual solution was seemingly 'find one of the staff on another site they're a member of and send them a message there'. Made for a nice security hole too, since people could (and did) impersonate others and get given their accounts as a result. You need some sort of email (or other contact information, like a phone number) simply so people can get their account details back in a semi secure way.

sp332 11y ago
You can have a password reset feature, but it would be optional. If the person decides not to include their email, they would have to bug a mod who would maybe reinstate them. You could also use SMS or a twitter handle or even snail mail instead of requiring an email address.
- sghodas 11y ago
  You'd rather share your phone number or home address than your email address?
  - sp332 11y ago
    Instead of hiding my identity from the site, maybe I'd rather hide my use of the site from my email provider.
    - cwyers 11y ago
      They have access to every e-mail you send and receive, if you don't trust your e-mail provider to that extent you should probably change them.
- danneu 11y ago
  It's not that obvious how to delegate out a task that involves giving someone full access to an account when they ask for it. With an on-site "Contact Support" form, you can at least compare their IP address with historical login addresses. But that comes with its own weird problems like, for example, a sibling claiming their brother's account from the same household to read their juicy PMs or steal their credits or whatever. Or giving moderators access to more sensitive information and power than necessary. Password reset being "optional" just means that people are going to use your support system for it when they eventually forget their password or the initial registration session expires. Reddit and HN have optional email while your new website's only user just forgot their password without an email address on file. What are you going to do when they ask for help off site? And by the time you're fielding SMS and Twitter handle password resets, you may wonder why you didn't just put more emphasis on the email address input field. Now you're polishing your SMS or Twitter handle reset system that has far more narrow appeal/usage than an email system. Of course, at the end of the day, it depends on the type of service you're operating. But "make email optional" is a trade-off, not universally good advice. Spend too much time in the HN echo chamber and you'll just do things that work against your users. People can opt out via http://10minutemail.com/ http://10minutemail.com/.
danneu 11y ago
Agreed. Whenever I've made email addresses optional, it just means I can expect to do a bunch of manual "forgot my password" support. And it's hard to justify responding with "sorry, can't help you since you didn't input an email" when you're in the early stages of growth and your one active user's remember-me session finally expired. These days I prefer to require an email address. That way, the few users that want to opt-out can insert a bogus one.

by CM30 11y ago

sp332 11y ago

You can have a password reset feature, but it would be optional. If the person decides not to include their email, they would have to bug a mod who would maybe reinstate them. You could also use SMS or a twitter handle or even snail mail instead of requiring an email address.

sghodas 11y ago
You'd rather share your phone number or home address than your email address?
- sp332 11y ago
  Instead of hiding my identity from the site, maybe I'd rather hide my use of the site from my email provider.
  - cwyers 11y ago
    They have access to every e-mail you send and receive, if you don't trust your e-mail provider to that extent you should probably change them.
danneu 11y ago
It's not that obvious how to delegate out a task that involves giving someone full access to an account when they ask for it. With an on-site "Contact Support" form, you can at least compare their IP address with historical login addresses. But that comes with its own weird problems like, for example, a sibling claiming their brother's account from the same household to read their juicy PMs or steal their credits or whatever. Or giving moderators access to more sensitive information and power than necessary. Password reset being "optional" just means that people are going to use your support system for it when they eventually forget their password or the initial registration session expires. Reddit and HN have optional email while your new website's only user just forgot their password without an email address on file. What are you going to do when they ask for help off site? And by the time you're fielding SMS and Twitter handle password resets, you may wonder why you didn't just put more emphasis on the email address input field. Now you're polishing your SMS or Twitter handle reset system that has far more narrow appeal/usage than an email system. Of course, at the end of the day, it depends on the type of service you're operating. But "make email optional" is a trade-off, not universally good advice. Spend too much time in the HN echo chamber and you'll just do things that work against your users. People can opt out via http://10minutemail.com/ http://10minutemail.com/.

danneu 11y ago

Agreed. Whenever I've made email addresses optional, it just means I can expect to do a bunch of manual "forgot my password" support. And it's hard to justify responding with "sorry, can't help you since you didn't input an email" when you're in the early stages of growth and your one active user's remember-me session finally expired. These days I prefer to require an email address. That way, the few users that want to opt-out can insert a bogus one.