> Use email / phone numbers to identify users This isn't always good advice. Not everyone has a unique email address, and not everyone has a phone number. If

> Use email / phone numbers to identify users This isn't always good advice. Not everyone has a unique email address, and not everyone has a phone number. If you're dealing with technology-savvy adults, sure, go ahead. But demanding a unique email address or phone number is actually a high barrier for many people. Case in point, my services is used by families. It's common for them to share an email address, or for the youngest and oldest members not to possess a personal phone. They also frequently lose access to email accounts e.g. when changing ISP, which makes account recovery a painful manual process. So we use a domain-specific identifier combining a generated membership number and the family name, and this works out well. Bottom line, consider your user base when establishing an identity scheme. Don't blindly accept prescriptions for your data model.