I agree that even maintaining email addresses can be a security risk that I'd rather avoid. But many users expect this and will try to use their email even if

I agree that even maintaining email addresses can be a security risk that I'd rather avoid. But many users expect this and will try to use their email even if you give them a "username" prompt. My primary intent with requiring registration is to deter (a little) spam or bots or just bad behavior. Most content is readable anonymously but to POST to my database I want restricted to registered accounts. I suppose email with a verification step is the best way to go but increases friction and requires more thought to security. But it also allows for password recovery which you can't do unless you can associate an email with an account.