3 ms·

Guys,it's 2022! You shouldn't be requires to give out your email right along for verifying anything. Please allow the old dog to die. Site generated communicat

by _8j50 4y ago

Guys,it's 2022! You shouldn't be requires to give out your email right along for verifying anything. Please allow the old dog to die. Site generated communication should be entirely optional, and even then why not support signal,whatsapp, slack,discord,etc... (as a library of course). Fight spam? Use captchas. What I found out is email registration is very difficult without a phone number which in turn requires a government ID in most places. So email verification has become a lazy way to require govenment IDs for even the most basic sites. It is all built around user hostility. I have added items to a cart,tried to check out and then decided to cancel the whole thing because they have no guest(no-email) check out and require email registration several times this year. Why would they not just take my money? My payment itself is verficiation of anything email can verify? It is so stupid! Imagine being asked for your phone number and then they call your phone to verify it at every store or business you went to in person. I challenge any commercial site owner to prove that email registration improves their botrom line. For non-commercial sites, please understand that you are being needlessly hostile to your visitors, use federated authentication and provide a no-email registration path. Personally, I think registration itself is outdated. You want users to buy something or generate content on your site. You can still call it registration if you want but you don't need to do more than the bare minimum of authentication which when federated can mean not storing anything new or special about the user other than their login session and associate their content with the identities associated with that session. For example, if HN with github federated, this post and my submissions would be under my GH identity in HN's db, if I want to setup a HN profile, that too would be under that identity. Unless you have a specific need for it, there wouldn't be a table of users with my identity in it. Lastly, for those that use email as part of an authentication workflow: understand that the use's email security is now your responsibility, because even though you transfered risk lack of options means you are responsible for mandating email as point of failure. So if a user gets phished and damage is done on your site, your site is liable unless you are also providing email security training. There is a reason secret questions exist (although I don't like them), you are not suppose to allow control over an email account as the only factor of authentication requires to reset login credentials. The whole 2FA setup is meaningless if you do that.

remram 4y ago
People forget their passwords. If you do more than sell stuff one time and the user really need to get their account back, you need a way to send them a reset link or code. No way around it.
- _8j50 4y ago
  Only if you or the user refuse to use federated auth. And even then do you not have 2FA? Then your 2FA is reduced to 1FA by email? "There is no way around it" is such b.s., yes there is, pretend email does not exist, how would you do it? I think you skipped over parts of my post, there is a myriad of messaging applications if you insist control over some external account is the way to go. But really, the ideal way to do this would be have two sets of registration time challenges set. You can go with secret questions but also picture/emoji combinations, pins,patterns as the firsr piece and a second would either be a payment card for $0.01 charge or have them print one-time codes at registration time (second challenge skipped if second-factor auth is good). "I refuse to change" is what you are saying, you can think about this longer than a minute and come up with more and better ways than what I just mentioned. Not only is email based password reser unneccesary, it is dangerous and lazy.
  - remram 4y ago
    Email can replace only the password, leaving you with 2FA still. Another messaging channel is fine of course. You could replace email address by a phone number for SMS/WhatsApp/Signal. Is that more secure though? Would a user rather give your random app their phone number than email address? Secret questions are usually very much not secret (less safe than password). They are way easier to uncover about a person, and still very much subject to re-use across sites. I am telling you that I haven't found anything as good and you reply that I must not have taken a single minute to think about it. I guess there's nothing more for us to discuss.
    - _8j50 4y ago
      > Another messaging channel is fine of course. You could replace email address by a phone number for SMS/WhatsApp/Signal. Is that more secure though? Would a user rather give your random app their phone number than email address? Yes! Even insecure SMS is more secure than email. You know why? Because everybody and their mother is logging and inspecting email, I see people's reset codes and links all the time to everything from banks to porn sites! Many messaging systems including sms have no "account" to get phished either so while other attack vectors like malware infection remain (as with email), credential phishing as an attack vector is eliminated when using these messaging apps. Yes, many people in non-US countries use whatsapp,wechat,facebook or viber but don't even have an email until some retarded app forces them to get one just for the retarded registration system (in some, "internet access" even costs more with just FB,viber,whatsapp being the cheap default). Many gen-Z'ers also use messaging apps over email, it's like asking them to use aol or icq! And it is very convenient to block unwanted senders on those apps if you decide to sell their contact info or spam them with email (where with email it varies greatly with email client and provider). If you go by the numbers the majority of internet users are coerced into using email because people who design apps stuck in the 2000s. > Secret questions are usually very much not secret (less safe than password). They are way easier to uncover about a person, and still very much subject to re-use across sites. Depends a lot on how you implement them, again if you read my comment before replying I suggest pictures,emoji and patterns, you can ask them just about anything so long as it isn't information about them others can also learn easily. It is no different than passwords themselves being reused across sites, except here you control what easy to remember questions and answers to ask like "what are your too three emoji from this list" or "create a passphrase from a combination of these common words below", again, not a difficult problem unless in 2022 your assumption is there are many internet users incapable of remembering anything more than their mothers maiden name (who even knows that shit?) or whatever in which case there are plenty of other ways to provide challenges. > I am telling you that I haven't found anything as good and you reply that I must not have taken a single minute to think about it. I guess there's nothing more for us to discuss. You literally ignored the possibilities I listed, if you are disagreeing with my comment in ignorance of what I said then yes, let's not waste our time here.

by _8j50 4y ago

remram 4y ago

People forget their passwords. If you do more than sell stuff one time and the user really need to get their account back, you need a way to send them a reset link or code. No way around it.

_8j50 4y ago
Only if you or the user refuse to use federated auth. And even then do you not have 2FA? Then your 2FA is reduced to 1FA by email? "There is no way around it" is such b.s., yes there is, pretend email does not exist, how would you do it? I think you skipped over parts of my post, there is a myriad of messaging applications if you insist control over some external account is the way to go. But really, the ideal way to do this would be have two sets of registration time challenges set. You can go with secret questions but also picture/emoji combinations, pins,patterns as the firsr piece and a second would either be a payment card for $0.01 charge or have them print one-time codes at registration time (second challenge skipped if second-factor auth is good). "I refuse to change" is what you are saying, you can think about this longer than a minute and come up with more and better ways than what I just mentioned. Not only is email based password reser unneccesary, it is dangerous and lazy.
- remram 4y ago
  Email can replace only the password, leaving you with 2FA still. Another messaging channel is fine of course. You could replace email address by a phone number for SMS/WhatsApp/Signal. Is that more secure though? Would a user rather give your random app their phone number than email address? Secret questions are usually very much not secret (less safe than password). They are way easier to uncover about a person, and still very much subject to re-use across sites. I am telling you that I haven't found anything as good and you reply that I must not have taken a single minute to think about it. I guess there's nothing more for us to discuss.
  - _8j50 4y ago
    > Another messaging channel is fine of course. You could replace email address by a phone number for SMS/WhatsApp/Signal. Is that more secure though? Would a user rather give your random app their phone number than email address? Yes! Even insecure SMS is more secure than email. You know why? Because everybody and their mother is logging and inspecting email, I see people's reset codes and links all the time to everything from banks to porn sites! Many messaging systems including sms have no "account" to get phished either so while other attack vectors like malware infection remain (as with email), credential phishing as an attack vector is eliminated when using these messaging apps. Yes, many people in non-US countries use whatsapp,wechat,facebook or viber but don't even have an email until some retarded app forces them to get one just for the retarded registration system (in some, "internet access" even costs more with just FB,viber,whatsapp being the cheap default). Many gen-Z'ers also use messaging apps over email, it's like asking them to use aol or icq! And it is very convenient to block unwanted senders on those apps if you decide to sell their contact info or spam them with email (where with email it varies greatly with email client and provider). If you go by the numbers the majority of internet users are coerced into using email because people who design apps stuck in the 2000s. > Secret questions are usually very much not secret (less safe than password). They are way easier to uncover about a person, and still very much subject to re-use across sites. Depends a lot on how you implement them, again if you read my comment before replying I suggest pictures,emoji and patterns, you can ask them just about anything so long as it isn't information about them others can also learn easily. It is no different than passwords themselves being reused across sites, except here you control what easy to remember questions and answers to ask like "what are your too three emoji from this list" or "create a passphrase from a combination of these common words below", again, not a difficult problem unless in 2022 your assumption is there are many internet users incapable of remembering anything more than their mothers maiden name (who even knows that shit?) or whatever in which case there are plenty of other ways to provide challenges. > I am telling you that I haven't found anything as good and you reply that I must not have taken a single minute to think about it. I guess there's nothing more for us to discuss. You literally ignored the possibilities I listed, if you are disagreeing with my comment in ignorance of what I said then yes, let's not waste our time here.