> How does this handle people changing their emails? It can, as long as the email change request can be synced as well. It may have some security problem need

> How does this handle people changing their emails? It can, as long as the email change request can be synced as well. It may have some security problem need to be resolved, but I think it can be worked out. > Can you do the same thing with a cryptographic signing key or something, instead? It's actually an better idea. If I can implement something like PGP (With maybe WebAuth), then user only needs to submit their public key. When authentication is needed, server will sends challenge (Message encrypted by user's public key), then user decrypts it with their private key, send the decrypted message back to server for verification. However, I'm still figuring out the whole WebAuth thing, so no decision is made yet. > This may or may not apply to your site, but, in general I don't want other users of a website to be able to PM/email me unless I specifically authorize them to. I actually like to encouraging user to make contact by themselves with their emails, because service email is decentralized and controlled by users (At least they have better control of it than a website). Also, user may left a website but still using their email. However, I know in real world, people don't like to be bothered, so make their email public could be a problem. I guess I need to rethink it a little.