4 ms·

I have spoken about this many times on HN. It comes down to this: email is being used in many nefarious ways and it is an ancient protocol with many insecuritie

I have spoken about this many times on HN. It comes down to this: email is being used in many nefarious ways and it is an ancient protocol with many insecurities. Anonymous email works for a bit but then every service worth using starts banning the providers. Both reddit and HN prospered as a result of not requiring email, that should tell you a lot about how horrible it is. It's on the same level as social security numbers being used as a secure secret that identifies a person. Email was not meant to be abusef this way, and I have seen first hand how it can be used against people so I have chosen it as my figurative "hill to die on". Now, if I can give a limited use address that cant be tied to me as an individual,expires after a period of time and messages are E2EE encrypted with no metadata leakage I don't mind that. I have spent almost an entire day trying to sign up to one service withour having to give up my phone number,real IP,creditcard or real email address to anyone as a challenge. I have tried countless anonymous email providers and sms code receiving services. I failed. Email abd phone number collection is a modern tech evil for me.

judge2020 6y ago
The problem is always 'how do i allow this user to reset their password', or more 'how do i verifiably contact the user'/'how do i verify someone emailing support is who they say they are' - without email, it's completely on the user to know and remember their password, something a lot of people can't do (and most don't use a p/w manager). HN does fine here since it's a 'tech' community where the majority likely does use a password manager, and Reddit gets away with it since their UI is so quiet about the email being optional - almost everyone thinks it's a required field since other websites require it and it looks just like the u/p field.
- badrabbit 6y ago
  If you choose to opt out of email then you also choose to opt out of email support and being able to reset passwords via email. Two factor auth solutions let you store a one time recovery code for example that you write down or store somewhere safe, that's one option if you care to support it but I wouldn't mind losing the email only features you mentioned either.
  - TulliusCicero 6y ago
    > If you choose to opt out of email then you also choose to opt out of email support and being able to reset passwords via email. And the users will get mad and blame the service provider. That said users are dumb/wrong or whatever is irrelevant, what matters to the business is that they're pissing off users and getting a bad reputation. Thus, requiring emails from the user is entirely rational and in fact is a good business practice.
    - badrabbit 6y ago
      No, making it a default makes sense. Users will not get mad if they get a warning telling them email support will no longer be possible. Alternatively you can opt with giving them a recovery code by which they can contact support or with which email will be enabled for an account when the user forgets their password. The only time you can't turn on email on your account is if you lose the password. Email is not secure, a user that has their login compromised is very likely to also have their email compromised. Moreover, if their email is compromised this completely silly dependence on email will get their account on your site compromised as well so you should be using a non-email means of authenticating users for support or account recovery!! Email must die. No buts or ifs. It must die. You are a poor or ignorant engineer and architect if you build new things that depend on email in 2020. If you give the most mediocre hacker 100 emails of users of your service that depends on email for account security, I am confident he/she will compromise at least a 3rd of accounts.
      - chrisan 6y ago
        > Email must die. No buts or ifs. It must die. You are a poor or ignorant engineer and architect if you build new things that depend on email in 2020. You have three fingers pointing back at yourself
      - TulliusCicero 6y ago
        > Users will not get mad if they get a warning telling them email support will no longer be possible. Yes, they will. Most will not have even noticed the warning you put up.
f1refly 6y ago
>email is being used in many nefarious ways and it is an ancient protocol with many insecurities Yes. But this doesn't make it a bad protocol to use. Email is one of the best things that remain for individiuals who value their privacy. It's pretty much the only popular messaging tool that doesn't require a phone number and isn't tied to one vendor. >Both reddit and HN prospered as a result of not requiring email This is untrue. HN and reddit prospered because users wanted to use the service, not because they don't require email to set up an account. If you have any evidence that suggests otherwise, please tell me, I'd be very interested in resources on that topic. To contradict your point: Pretty much every other website, regardless it it's a small one man operation or a giant company require email or even a working phone number, and those seem to be doing just fine. >Email was not meant to be abusef this way Well, how is it "abused" in it's current form? It's electronic mail, so people use it as such >and I have seen first hand how it can be used against people And how would that look like >Email abd phone number collection is a modern tech evil for me You should strike email from that list. Phone confirmation is the real problem, because it is tied to your identity in most of the western hemisphere now. However, there's still plenty of serious email providers where you can start a trial account to sign up of whatever requires it, just don't use the usual blacklisted expiring address suspects. I can highly recommend mailbox.org, they provide a very good service and have a 30 day trial period for new accounts.

judge2020 6y ago

The problem is always 'how do i allow this user to reset their password', or more 'how do i verifiably contact the user'/'how do i verify someone emailing support is who they say they are' - without email, it's completely on the user to know and remember their password, something a lot of people can't do (and most don't use a p/w manager). HN does fine here since it's a 'tech' community where the majority likely does use a password manager, and Reddit gets away with it since their UI is so quiet about the email being optional - almost everyone thinks it's a required field since other websites require it and it looks just like the u/p field.

badrabbit 6y ago
If you choose to opt out of email then you also choose to opt out of email support and being able to reset passwords via email. Two factor auth solutions let you store a one time recovery code for example that you write down or store somewhere safe, that's one option if you care to support it but I wouldn't mind losing the email only features you mentioned either.
- TulliusCicero 6y ago
  > If you choose to opt out of email then you also choose to opt out of email support and being able to reset passwords via email. And the users will get mad and blame the service provider. That said users are dumb/wrong or whatever is irrelevant, what matters to the business is that they're pissing off users and getting a bad reputation. Thus, requiring emails from the user is entirely rational and in fact is a good business practice.
  - badrabbit 6y ago
    No, making it a default makes sense. Users will not get mad if they get a warning telling them email support will no longer be possible. Alternatively you can opt with giving them a recovery code by which they can contact support or with which email will be enabled for an account when the user forgets their password. The only time you can't turn on email on your account is if you lose the password. Email is not secure, a user that has their login compromised is very likely to also have their email compromised. Moreover, if their email is compromised this completely silly dependence on email will get their account on your site compromised as well so you should be using a non-email means of authenticating users for support or account recovery!! Email must die. No buts or ifs. It must die. You are a poor or ignorant engineer and architect if you build new things that depend on email in 2020. If you give the most mediocre hacker 100 emails of users of your service that depends on email for account security, I am confident he/she will compromise at least a 3rd of accounts.
    - chrisan 6y ago
      > Email must die. No buts or ifs. It must die. You are a poor or ignorant engineer and architect if you build new things that depend on email in 2020. You have three fingers pointing back at yourself
    - TulliusCicero 6y ago
      > Users will not get mad if they get a warning telling them email support will no longer be possible. Yes, they will. Most will not have even noticed the warning you put up.

f1refly 6y ago

>email is being used in many nefarious ways and it is an ancient protocol with many insecurities Yes. But this doesn't make it a bad protocol to use. Email is one of the best things that remain for individiuals who value their privacy. It's pretty much the only popular messaging tool that doesn't require a phone number and isn't tied to one vendor. >Both reddit and HN prospered as a result of not requiring email This is untrue. HN and reddit prospered because users wanted to use the service, not because they don't require email to set up an account. If you have any evidence that suggests otherwise, please tell me, I'd be very interested in resources on that topic. To contradict your point: Pretty much every other website, regardless it it's a small one man operation or a giant company require email or even a working phone number, and those seem to be doing just fine. >Email was not meant to be abusef this way Well, how is it "abused" in it's current form? It's electronic mail, so people use it as such >and I have seen first hand how it can be used against people And how would that look like >Email abd phone number collection is a modern tech evil for me You should strike email from that list. Phone confirmation is the real problem, because it is tied to your identity in most of the western hemisphere now. However, there's still plenty of serious email providers where you can start a trial account to sign up of whatever requires it, just don't use the usual blacklisted expiring address suspects. I can highly recommend mailbox.org, they provide a very good service and have a 30 day trial period for new accounts.