4 ms·
I honestly can't think of a reason you'd ask a user for their email but not need to validate it. For being able to do password resets later, permission to add
by gregmac 10y ago
I honestly can't think of a reason you'd ask a user for their email but not need to validate it.
For being able to do password resets later, permission to add to mailing list, avoiding sending private info to the wrong user, avoiding allowing someone to masquerading or impersonate someone they're not.. All should be validated.
If you're looking for a username as login identity and nothing more (and you don't have password reset functionality), then ask for a 'username', not email addresses.
- vacri 10y agoemail addresses for usernames have the advantage of already being unique. None of this "gregmac already taken, try gregmac23, gregmc_595, or verbingnounXX instead?" nonsense
- zAy0LfpBZLC8mAC 10y ago> email addresses for usernames have the advantage of already being unique Not true. There are people who share an email address.
- niij 10y agoCare to expand? As in having a first.last@example versus firstlast@example
- mabcat 10y agoAs in bloggsfamily@localisp.net.au that both parents and all the younger sprogs share. Still common as anything.
- vacri 10y agoOne of the things I loved about the original Mad Max film was that they nicknamed their own toddler 'Sprog'...
- pcl 10y agoProbably the most common example these days is spouses who don't email regularly. Once upon a time, you only got one or two email addresses from your email provider (I'm looking at you, CompuServe and AOL), so at that time it was common for everyone in a family to have a single address. Eventually they added explicit multi-user features -- IIRC, AOL went as high as 5 emails per account before my family moved on.
- roywiggins 10y agoI have family who share one email between two spouses. They might maintain separate personal email addresses; probably not, though.
- vacri 10y agoI mean unique as far as your end is concerned. Short of very invasive technology, there's no way to stop people from sharing a user token if they choose to do so.
- zAy0LfpBZLC8mAC 10y agoExcept, it's not a "user token", it's an address. It's as much a user token as a postal address or a telephone number is a "user token": not at all. It's a way to contact a person, not a way to identify a person. Just because you can enforce that only one person with a given postal address can create an account with your service, doesn't make it an inherent "user token".
- throwanem 10y agoYep. I designed a system once around the assumption of a 1:1 mapping between people and email addresses. I will never design another system that way.
- Kadin 10y agoSure, but what if two humans share an email address, but both of them want to sign up for your game/service/whatever independently? This is a fairly common situation if you are (say) designing a game that might appeal to kids. Or old people. If you block that, you're going to lose users. Either because they just can't sign up at all, or because there's too much unnecessary friction in requiring someone to go out and sign up for an email address just to register for your service.
- gregmac 10y agoI agree, but in that case, you should be validating the e-mail address (which was my original point). Failure to do so means: - The user who actually owns that e-mail can't login - The user who signs up can potentially impersonate the real user (depending on what your app does) - The user who signs up can't reset their password - The user who actually owns the e-mail can take ownership of the account (by resetting password)
- vacri 10y agoFair points. One argument against emails-as-names is that some people change email addresses frequently - unless you have some way of accounting for that (and you definitely wouldn't use the username as the contact field), the username will eventually go stale for some users.
- sethammons 10y agoAnother argument against: some couples share email accounts but may want separate accounts on your service. Yes, this happens.
- gregmac 10y agoYou should allow changing the e-mail address. Of course, changing it requires the same validation, but I'm not really sure why there'd be an argument against it (though I do note many sites/applications don't have a mechanism for this). At the same time, as a user, you need to consider your own e-mail setup. You should not use your ISP-provided e-mail address whatsoever, there is absolutely no reason to tie your contact to an account you may not keep. Likewise, you should not be using your school or work-provided addresses for something that you expect to use beyond going to school or having that job. If you're changing your e-mail address frequently for personal reasons (eg, someone harassing you?), then you should actually consider creating an account you use only for authentication, and a separate one that is your public-facing persona. Having separate addresses for your contact and sign-ups is actually not a bad idea anyway. It actually makes it a bit harder for someone to break into your account somewhere (because they don't necessarily know what address you used), and you get the freedom to change/abandon your public e-mail address if necessary.
- pbreit 10y ago"For being able to do password resets later" - don't need to validate. Mailing list - reluctant OK "avoiding sending private info to the wrong user" - how could this happen? "avoiding allowing someone to masquerading or impersonate someone they're not" - how could this happen? Like if I signed up as tim@apple.com? What could realistically happen?