3 ms·

Depends: do you /need/ to know who they are? Or do just you need to know they aren't some bot? Depending on what you are doing, your going to have to think of

Depends: do you /need/ to know who they are? Or do just you need to know they aren't some bot? Depending on what you are doing, your going to have to think of whats appropriate and keep in mind: the more you collect, the more secure/oversight you'll probably need. I've been thinking on this on my app, and I don't really need to know who they are, in fact I would prefer they couldn't use whatever they normally go by on other sites (prevent name squatting, spoofing, etc), that there clearly is no assumption by username/handle you are communicating with is who you think they are. So minimally I would want: User Name (handle) Email or Text number (verification) Login password Now, thinking on no previous usenames, to reduce the instance of actual user name/handle I plan to require a first and last user handle with one of either being a name from a supplied list of generic names, the other something they come up with. The list of names would include stuff like this: 'Coyote' ,'Crazy' ,'Desert' ,'Doc' ,'Dog' ,'Farmer' ,'Forrest' In answer to your question, if it was a different app I'd do something completely different. You have to get in the mind of your audience and your revenue source of what would be appropriate.

czep 10y ago
I agree that even maintaining email addresses can be a security risk that I'd rather avoid. But many users expect this and will try to use their email even if you give them a "username" prompt. My primary intent with requiring registration is to deter (a little) spam or bots or just bad behavior. Most content is readable anonymously but to POST to my database I want restricted to registered accounts. I suppose email with a verification step is the best way to go but increases friction and requires more thought to security. But it also allows for password recovery which you can't do unless you can associate an email with an account.
- LarryMade2 10y ago
  My thoughts too, people forget passwords a lot. Well theres also message number possibility with twilio looks pretty cheap to do sms/voice verification. then you can get the mobile crowd too.

czep 10y ago

I agree that even maintaining email addresses can be a security risk that I'd rather avoid. But many users expect this and will try to use their email even if you give them a "username" prompt. My primary intent with requiring registration is to deter (a little) spam or bots or just bad behavior. Most content is readable anonymously but to POST to my database I want restricted to registered accounts. I suppose email with a verification step is the best way to go but increases friction and requires more thought to security. But it also allows for password recovery which you can't do unless you can associate an email with an account.

LarryMade2 10y ago
My thoughts too, people forget passwords a lot. Well theres also message number possibility with twilio looks pretty cheap to do sms/voice verification. then you can get the mobile crowd too.