5 ms·

Another rule: DON'T FORCE PEOPLE TO USE AN E-MAIL ADDRESS AS THEIR USER ID. Such an amateur-hour mistake: https://goldmanosi.blogspot.com/2012/06/forcing-peopl

Another rule: DON'T FORCE PEOPLE TO USE AN E-MAIL ADDRESS AS THEIR USER ID. Such an amateur-hour mistake: https://goldmanosi.blogspot.com/2012/06/forcing-people-to-use-e-mail-address-as.html https://goldmanosi.blogspot.com/2012/06/forcing-people-to-us...

kijin 8y ago
People use the same user ID all over the place anyway. That includes the part before the "@" in their email address. If any one of those credentials is leaked, the damage is the same. At least the email address can be easily changed when needed, whereas most sites don't allow changing the user ID.
- dingaling 8y ago
  Many years ago I used a forum that autogenerated usernames from a hash of responses to questions ( player name, age, city etc ) in a similar manner to those 'porn name' algorithms. Which was quite a relief in place of the usual 'invent a unique name' mindblank I often suffer. Similarly my banks issue me my website user strings. Why do so many website permit users to choose? Forcing the user to write-down their assigned designator might lead to better security, too, since they would seem at that point more open to writing-down a strong password.
Dylan16807 8y ago
That's not at all convincing. A username+password is probably more likely to be reused than email+password.
alkonaut 8y ago
I prefer having to just hit “forgot password” over hitting first “forgot username” and then forgot password... Even with the security risks I prefer email login. Logins are in 2 categories: a) stuff I don’t care if it’s compromised. Basically forum memberships, preferences on various sites such as retailers storing a shipping address but no payment details. b) Important things such as my email account. For category a) sites (hundreds) I use a crap password that has been owned already. It’s 5 chars and the same on most sites. It’s been in pwned dbs for years. I can’t be bothered to use a person manager if it’s more work than 5 keystrokes to do on any platform. For category b) sites (say ten or something) I use long unique passwords and 2FA. Obviously it’s better to put everything in b), but I’m lazy. So as a good second best I take good care of the important passwords.

kijin 8y ago

People use the same user ID all over the place anyway. That includes the part before the "@" in their email address. If any one of those credentials is leaked, the damage is the same. At least the email address can be easily changed when needed, whereas most sites don't allow changing the user ID.

dingaling 8y ago
Many years ago I used a forum that autogenerated usernames from a hash of responses to questions ( player name, age, city etc ) in a similar manner to those 'porn name' algorithms. Which was quite a relief in place of the usual 'invent a unique name' mindblank I often suffer. Similarly my banks issue me my website user strings. Why do so many website permit users to choose? Forcing the user to write-down their assigned designator might lead to better security, too, since they would seem at that point more open to writing-down a strong password.

Dylan16807 8y ago

That's not at all convincing. A username+password is probably more likely to be reused than email+password.

alkonaut 8y ago

I prefer having to just hit “forgot password” over hitting first “forgot username” and then forgot password... Even with the security risks I prefer email login. Logins are in 2 categories: a) stuff I don’t care if it’s compromised. Basically forum memberships, preferences on various sites such as retailers storing a shipping address but no payment details. b) Important things such as my email account. For category a) sites (hundreds) I use a crap password that has been owned already. It’s 5 chars and the same on most sites. It’s been in pwned dbs for years. I can’t be bothered to use a person manager if it’s more work than 5 keystrokes to do on any platform. For category b) sites (say ten or something) I use long unique passwords and 2FA. Obviously it’s better to put everything in b), but I’m lazy. So as a good second best I take good care of the important passwords.