5 ms·
I agree. I recall Reddit would just require a user id and a password to use their site. I liked that model. I guess they eventually goaded you into giving their
by tictoc 7y ago
I agree. I recall Reddit would just require a user id and a password to use their site. I liked that model. I guess they eventually goaded you into giving their email, but there are alternatives to password recovery than a forget my email link.
- JeremyBanks 7y agoSuch as?
- jethro_tell 7y agostoring the password in plain text so you can just find it in a data breach when you loose your password.
- Deimorz 7y agoOn Tildes, I let people add a recovery email address for their account, but I hash it (with Argon2), and if anyone needs to do an account recovery they have to send an email requesting it from that address, including their username. Then I hash the sending email address and only send reset info back if it matches the stored hash for the account. There are still some minor issues with doing it that way, but it's much, much better than storing plaintext email addresses. I don't know of any other sites doing it this way, but I wouldn't be surprised if others have thought of the same method.
- Deimorz 7y agoGiving an email on reddit is still technically optional, but they try to make that unclear. During registration you can just leave the email field blank and click "Next" to skip giving one, even though there's no indication at all that it's optional. The site also annoys you constantly now to add an email address, but you can ignore or adblock that.