20 ms·
Email addresses are not good 'permanent' identifiers for accounts
- User23 3y agoFor a long time Amazon’s unique ID for accounts was email + password. So people that forgot their password would end up with two separate accounts using the same login name and which one they got depended on the password.
- dastbe 3y agothis was done to support a historically common pattern: people sharing email addresses who still wanted distinct accounts.
- ceejayoz 3y agoWhat about the historically common pattern of forgetting the password?
- lostmsu 3y agoI've seen companies ask you to enter any password that you remember.
- explaininjs 3y agoYou don’t really lose anything by losing your Amazon account. It’s not like precious data is stored there. It might make returns more difficult, but in some sense that’s a feature from their perspective, and in any case it’s just another entry in their master support call center flow chart
- ceejayoz 3y agoI would lose all my purchased Kindle books. Until this year, quite a few people would've also lost their AWS access that way.
- explaininjs 3y agoSure, but I believe this predates Kindle. Either way, that’s a matter for the call center flow chart to handle. Not everything needs to be in software.
- paulryanrogers 3y agoThis is my experience as well. A random UUID is best IMO. Even a hash of the user's initial email isn't ideal since salting may not be enough, and others may assume they can safely hash any incoming email.
- crabmusket 3y agoIs there ever a reasonable case for a "natural ID" like we were taught in database school? In my working experience, I always use either an autoincrementing integer or a random string / uuid as the primary key.
- twodave 3y agoA few examples come to mind: geographic regions that already have codes or abbreviations associated with them (e.g. a FIPS code or state abbreviation in the US), simple enums (though I really only bother putting these in a table if they’re used in multiple places). Have to be careful using a string as the clustered index of a large table, though. Smaller tables with shorter string keys that experience very few writes are most ideal for these cases.
- paulryanrogers 3y agoMaybe standardized time zone IDs
- adra 3y agoOne notable problem with user ids is that they tend to leak to users in some way. Because of this, it's really easy for competitive intelligence companies to bot create accounts just to get a feeling of new user growth if you're naively using auto increments. This maybe fine mom and pop sites, or sites where somehow the UID never leaves the middleware, but the reality is that using sequential IDs or hashes of them without salt aren't great for this reason.
- lysecret 3y agoYes two core benefits: 1. Built-in Deduplication. If your ID describes the "thing that it is" handling deduplication is much easier. Of course you can try to enforce it by enforcing uniqueness on other columns (but that's not always possible / can get tricky). 2. Save a DB trip on updates/some creations / make indexing more explicit. E.g. say you are user with email address and you want to update some info. Either you run an update using the email directly (in which case you are treating it as a PK essentially even if you don't call it that) or you first retrieve the relevant PK by whatever logic (say indexing by email and name or whatever) at which point you do have an implicit natural key. In my experience every time I have seen a "corporate" DB with non natural key you get a LOT of duplication and all sorts of services to try to resolve entities running in a batch way (the horror..). And 2 leads to a lot of bugs because of the implicit nature where you accidentally update the wrong or multiple rows because you didn't know what the implicit uniqueness "key" entailed.
- aaronharnly 3y agoSome of our customers (school districts) regularly recycle email addresses for students, reassigning an address to a new student after even just one year. That’s fine(ish?), but problematic when they don’t also provide a stable unique identifier that can signal the change. Identity management is a remarkably messy and hard problem — one of those areas where the “corner cases” add up to an order of magnitude more work than the core solution.
- nvm0n2 3y agoIt's not really fine and no organization should do that. The assumption that one email address = one person is too deeply embedded into the infrastructure. Tech firms mostly get this right. Consumer Google accounts are never reused for example. Yes it means the namespace becomes polluted over time and some people might have numbers at the end of their email address, and that's a pity, but compared to the pain of reallocating addresses it's not very important.
- palemoonale 3y ago[flagged]
- collaborative 3y agoThe post mentions the problem but not the solution?
- rovr138 3y agoYes. It’s bringing attention to the issue. That way people can discuss.
- nvm0n2 3y agoIt does but the solution is mundane: use an auto generated primary key.
- collaborative 3y agoThat in turn presents more problems
- mytailorisrich 3y ago> Even if you have to remember an email address for account recovery, you want your internal identifier for accounts to be meaningless. This will make your life much simpler in the long run, even if this is never exposed to people. This is the solution. The rest is an implementation detail ;)
- carafizi 3y agoThere is a client-side solution, even if not the most elegant. I'm paying a domain, this way i have 100% control of my e-mail alias, even if my current provider (google) goes south, i'm still able to host the mail on my own server to retrieve accounts, and maintain ownership or the alias
- rasengan 3y agoWhat if the domain expires?
- enioarda 3y agoLetting a domain expire is usually under your own control
- rasengan 3y agoWhat if you passed away and someone wants to access your old data by getting your old email domain Oo
- layer8 3y agoLike with everything else, one should make sure one’s heirs have all the relevant information.
- xoa 3y ago>What if you passed away and someone wants to access your old data by getting your old email domain Oo What exactly do you think happens to anything of yours after you die if you don't prep for it? With many organizations or property your heirs can use a death certificate or court order to get stuff, in other cases they may just be out of luck. You may even wish it to be so, do you actually want them to have access to your old data? All of it or only some? If you actually care then like anything you need to prep for that while you're still alive in any one of the numerous ways available. If you don't then tough shit, that's why there is constant reminders about setting up wills/trusts and keeping relatives/friends/colleagues in the loop as needed and so on and so forth.
- prepend 3y agoI think this is a backend issue in that for the user, their id is email, but within the systems’s data the primary key shouldn’t be email. Is anyone still doing this? It’s like the most basic db design issue to not use things like email as the identifier and instead have a lookup table that maps things to a truly unique id (uuid or maybe auto increment from a sequence). The article doesn’t really make this distinction so it almost reads like how users should be aware of this abstraction.
- liquidpele 3y agoYea… this is like a high school level DB class test problem, but you’d be surprised how many adult developers don’t stop to think about DB stuff…
- sedivy94 3y agoThat’s surprising to hear. I have zero DB experience, not am I a developer, and my default assumption is that some UUID maps to object / entry containing email address (and all other attributes).
- kayodelycaon 3y agoNatural primary keys (email, ssns, etc) was the standard for a long time. It was some kind of platonic ideal. Artificial keys were wasted space of random data that didn’t belong in a database. When I was in college, academics were just starting to grudgingly accept artificial primary keys (like UUID or auto-incrementing integers) as a concession to reality. To a modern developer natural primary keys sound insane. Artificial keys are faster in almost every way due to index size. You’re storing compact, fixed-size binary data instead of strings.
- prepend 3y agoI’ve been professionally making database since 1997 and “natural” primary keys was an antipattern even back then (along with the int sequence since it only allowed 2 or 4 billion). Socials change. Emails change. Seemingly natural, unchanging things change and mess up all the foreign key relationships.
- _ea1k 3y agoYes, there should always be some sort of unique identifier that is not tied to the users name or email. Display it in the user info, but really it shouldn't be used for anything outside of the technical integration with sso. Ideally, it would be something like a guid.
- buro9 3y agoThere is no good identity. Emails change, people lose access to old emails. People dislike usernames, they want to be able to choose non-unique ones rather than end up with user53267 or something inane. People lose devices, just storing a secret UUID in their cookie, or using a passkey from their device isn't going to work. There is no ideal solution except to blend a variety of things together, for some people email is pretty stable for long time and they like it as the identity, for others their usernames are stable and they prefer that as the identity... though I know of no-one that has had the same primary device for more than years (not decades) so perhaps that one will never work. I do think this is important though, where it comes up a lot is a work email account, a first.last@company.com, and how all of the vendor software utilises "Sign in with Google", and it's the email address they then store in the vendor app as the identifier... People get married, people get divorced, people transition, people move culture and choose new names... names change, and so do email addresses. Perhaps OIDC and the like needs a new extension: a standard API to change a username, and a standard API to change an email address.
- prepend 3y agoI think email plus a robust protocol for resolving changes works as good as can get. For important stuff like banks and pensions they also have phone and physical address, so there’s a way to reconcile things like email changes, as rare as they are.
- toomuchtodo 3y agoUS example. Financial services orgs have your social security number. Perhaps they should be able to forward a message to the US gov to forward it to the citizen stakeholder through a government messaging delivery platform. This ensures continuity of communication but does not allow orgs to lookup emails with loose data governance (and all that leads to). Login.gov is very good from a federal gov idp perspective, and I’m hoping it slowly develops into supporting a national ID and ubiquitous identity proofing to squash identity fraud but also streamline gov digital service delivery.
- 3y ago
- Pixie_Dust 3y ago> Email addresses are not good 'permanent' identifiers for accounts No s~~H Sherlock!
- bee_rider 3y agoshiH?
- jordanpg 3y ago> The biggest problem with email addresses as 'permanent' identifiers is that people's email addresses change even within a single organization (for example, a university). They change for the same collection of reasons that people's commonly used names and logins change. True for some cases, surely, but I will be surprised if I don't go to the grave in ~40 years with my current gmail account still intact (assuming email is still a thing). I assume this is true for some appreciable fraction of email users, although I couldn't hazard a guess of what fraction.
- Ekaros 3y agoIt will be a fun day if Google for some reason decides to kill gmail... I wonder if that will get government intervention...
- ChrisMarshallNY 3y agoThis is true, but I still use them, for the system I'm getting ready to release. The reason is that we want to keep as little PID as possible, and that should be as innocuous as possible. So we use emails, including obfuscated Sign In with Apple proxies, or even temporary DEAs. The only requirement is that the email be one that will receive emails.
- fastball 3y agoWe're actually in the process of changing around our email system to allow for multiple associated email addresses with an account right now. One of the main reasons for this is that we provide a student discount for people, and the easiest way to apply that to an account is by checking if their email is an educational one (.edu, .ac.uk, etc). However most people don't seem to want to actually signup with that email. So by allowing multiple emails we can have the best of both worlds! Wish we had done it this way in the beginning.
- ghaff 3y agoBe aware that at least in the US, many people who graduated from university can get an .edu alumni forwarding address. I have a rather cool one. I got in early on and it’s just my first name. I don’t use it much though. In the early days the forwarding made it sometimes unreliable although I assume it’s better now. And the reality is my gmail address has been stable over a couple decades at this point and I don’t see that changing. I give out my edu address to very few people in any case.
- fastball 3y agoThanks for the heads up. We're aware, but tbh are not that worried about it. If someone that has already graduated is keen to get a student discount, I'm happy to let them. They feel like they're beating the system, and we still get paid. Luckily we're not running a business where the educational discount users are some sort of loss-leading onramp that we expect to make money on once they graduate – they're still profitable even at 50% off. Currently we actually require manual verification (sending in a student ID to our Intercom) if you didn't sign up with a educational email, and I'm deliberately overlooking the proofs that are clearly invalid. I barely even glance at them. The other day day someone sent me a student ID that was 4 years expired and I just applied the discount and moved on with my day haha. If you send me a PDF called "student_id.pdf" I'll probably give you the student discount. That's part of the reason we're adding this system – we've gotten so lazy that requiring people to go the email verification route will probably be a stricter improvement on the status quo if most users go that route.
- block_dagger 3y agoWorldCoin is coming…
- sigwinch28 3y agoOne of my previous energy providers (British Gas, owned by Centrica) didn’t allow an email address to be used for more than one physical address. When I moved and tried to “set up” my online account I kept getting HTTP 500s when trying to view details about my current address. On the phone they told me “sorry, you can’t use the same email address for multiple [postal] addresses”, even with closed energy accounts from previous addresses.
- xtracto 3y agoYou could use the +whatever trick. Or if in Gmail, the dot . Trick.
- ooterness 3y agoSadly, there's a lot of companies with misguided email validation. They often insist "+" cannot be used in an email address.
- chii 3y agoluckily, for cases like these, you can add a dot anywhere within the email address before the @ symbol for gmail, and it goes to the same email address as without the dot.
- layer8 3y agoThat’s bad, but is one of the things that aren’t a real problem if you use your own domain for email.
- NorwegianDude 3y agoThe only decent solution I can think of is passkeys. Cross device synced identites that the user can choose a service for. Just having a random ID isn't good enough, unless you want the user to remember this ID.
- skwashd 3y agoMany of the same issues apply to phone numbers. When moving countries it can be difficult if not impossible to retain your existing phone number. In some parts of the world moving states means changing your mobile number. Most telcos “recycle” deactivated numbers after a period of time. This often as short as 6 to 12 months after the owner’s credit expires. I’ve found it increasingly common for a prepaid local SIM number to be tied to a previous owner’s accounts on popular services.
- BrandoElFollito 3y ago> When moving countries it can be difficult if not impossible to retain your existing phone number. I cannot imagine how it cos be possible in the first place. I have a French number: +33 and 9 digits. In Germany it is +49 and 10 digits. In Poland +48 and again 9 digits. How do you imagine porting a national phone number abroad?
- avandekleut 3y agoThere are several countries with the same format and country code.
- BrandoElFollito 3y agoEven if some countries share the same code and format (I know about the US and Canada), this is hardly a universal solution. The vast majority do not.
- skwashd 3y agoI was thinking porting your number to twilio or the like. It’s not supported in all countries.
- beanjuiceII 3y agoemail works great for me, got it when gmail was created still have it
- beckerdo 3y agoThe best identity I can think of is a hash-code of your DNA sequence. You cannot lose it like an external device, an email, or an implanted chip. Yes, there might be collisions in a DNA hash-code (such as identical twins), but there can be protocols for that.
- brewmarche 3y agoAnother potential problem: https://en.wikipedia.org/wiki/Chimera_%28genetics%29 https://en.wikipedia.org/wiki/Chimera_%28genetics%29
- explaininjs 3y agoThis keeps coming up but is a terrible idea. Your DNA changes every second.
- 8organicbits 3y agoAnyone who has tried to de-Google their online presence runs into this. Many sites don't let you change your email address so you either create a new account or live with mail forwarding. OAuth is often worse at this, I have too many third party sites using Log in with Google, forces me to keep a Google session open (in a Firefox container).
- taeric 3y agoFor most users, they are probably as good as you can get? Without attestation, no solution "works." So, either have an identity in your community that is specifically not linked to definitive people, or realize you ultimately need a way to link to whatever the local government uses, at some level. Right?
- sl0wik 3y agoPerhaps identity should be a form of graph including accounts you had over period of time instead of single input.
- liveoneggs 3y agoNothing is permanent. Hardly anything is stable even throughout the entire human lifespan. No bio markers that can be easily scanned are reliably unique across a large enough population. Email addresses are reliably unique (for a reasonably long time), which is why they are chosen for this purpose. Phone numbers are now more "sticky" than they used to be and are now similar to email addresses at being useful identifiers. Both emails and phone numbers are frequently lost, often at the same time. Backup email addresses are the way to go. Github does a good job at identity, I think, but they still use passwords (which are bad).
- Mattasher 3y agoAgreed that emails aren't a good permanent identifier. Though using phone numbers as any part of identification is even worse. I've had the same email for almost two decades (through my own domain name), but I've gone through nearly a dozen phone numbers in the same time period, and regularly find that a website has opted me in to 2fa with an old number, or I've forgotten they had an old phone number to begin with. I am currently paying a ~$150 per month "tax" to AT&T to keep my US number while living abroad just so I can get login codes for websites that still have that number, and out of fear that if I dump it I'll lose access to some occasionally vital service that I've forgotten to update, or I can't because you need to have a US number.
- BrainBacon 3y agoYou don't need to pay that much to keep a US number for use abroad. Convert any 2fa you can to use an app like Google Authenticator, then convert your number to Google voice. You can get text messages for free using your old number that way. If you don't want Google involved at all, there are many other time-based authentication apps and you can use www.tossabledigits.com for texts.
- mililani 3y agoThe problem with your idea is there are lots of services that blacklist VoIP #'s like Google Voice from being used for 2FA. They also don't have modern 2FA options like TOTP.
- ThePowerOfFuet 3y ago> I am currently paying a ~$150 per month "tax" to AT&T to keep my US number while living abroad just so I can get login codes for websites that still have that number Port it to a VoIP company like DIDww, spend $2.50/month, and received SMS can end up in your inbox if you wish. If you ever want the number on a mobile account again, port it back out to your choice of carrier.
- Mattasher 3y agoWill that work seamlessly overseas and with my iPhone? I've had issues in the past getting verification calls and SMSes with "virtual" carriers.
- r3trohack3r 3y agoIdentity is fiat. There is no such thing as a permanent identifier for an account. There is no good way to reliably map any identifier to a human. There is only social attestation. Any identity system that fails to recognize this will fail to model societal constructs. http://www.blankenship.io/essays/2023-09-24/ http://www.blankenship.io/essays/2023-09-24/
- user234683 3y agoWhat is the best approach to dealing with this problem as an individual? Gmail? You might randomly get locked by some AI algorithm (or you might get banned!), or something else goes wrong, and there's no recourse. Yahoo? I recently lost access to mine because they decided to start demanding verification with a deactivated email I haven't had access to for 15 years in order to login. Luckily, I had access in an email client, so I was able to migrate all the important accounts off of it. Yahoo/AOL/Tutanota/Protonmail/Many others? These ones will auto-delete your account if you don't login frequently enough (not protonmail yet, but they allow it in their TOS) Self-host? All self-hosting infrastructure requires an email in the first place. Lose access to that email, lose access to payment reminders, potentially your hosting account. I nearly lost my domain since the payment reminders went to an email that I rarely check because it doesn't support IMAP. And there is a greater increase of hacking unless you're a professional sysadmin and have plenty of time for maintenance. Duo push? Your phone breaks. SMS verification? Phone breaks, lose access to your plan, compromised employee gives your codes away, etc. I've settled on using my university gmail address since (1) they promise alumni can keep it and (2) if something goes wrong with it (likely losing 2-factor by losing my phone), there is a good alumni support center. There really needs to be a human I can talk to somewhere. Still not sure if this is the best approach; am I still at risk from Google here?
- Horffupolde 3y agoYou are missing the best solution which is your own domain and hosted email like Gmail. If you get locked out like you said, “just” change providers and you lose at most a couple of hours of emails.
- arp242 3y agoYou can lose a domain though, so that's not perfect or guaranteed either. That said, it probably is the best option right now.
- diggan 3y agoUnless you're actively committing something that can be considered a crime in the jurisdiction of your registrar, you're unlikely to just loose it though. Unless you're hosting stuff at CloudFlare and they decide you're a "bad person", then anything goes.
- remram 3y agoNote that using user-selected nicknames is not great either. I am learning this the hard way. Example problems: * Person used their real name, got married, changed last name * Person used their real name, transitioned, changed their first name * Person used characters that you no longer want to accept in nicknames * Person used a nickname that you now want to reserve (e.g. "admin", "contact", "help", ...) * Person used a very silly name and grew up or started using your service at their job
- uxp8u61q 3y ago> * Person used characters that you no longer want to accept in nicknames Why would you refuse certain characters? My last name contains a dash and one letter with a diacritic. I am beyond tired of playing whack-a-mole trying to guess what rule I violated with my "invalid name." And fuck companies who have the gall to call my name "invalid" to my face, too. Have some thought before you write an error message. "Contains an invalid character" wouldn't be insulting, for example.
- remram 3y agoI am talking about usernames, not names. My first name also contains an accent, maybe direct your rage somewhere else? If nicknames appear in URLs for example, or are a way to direct messages at someone (e.g. github.com/<nick>, @<nick>), using non-ASCII characters is a bad idea.
- poisonborz 3y agoIdentities should be selfhosted just like most of cloud services. All the problems related to this are unsolved only because the profit incentive points to the opposite.
- jgalt212 3y agoI like usernames as they are much more robust to credential stuffing than email addresses.
- Pxtl 3y agoYeah, I'm always surprised that Google doesn't offer a way to change your account address. Like there's no way to say "this is my new Gmail address and all email to the old address will be forwarded to the new one and this new address will take over". Google accounts include purchase ownerships and the like. Dropping an old one and starting a new one is non-trivial. And most reasonable people make their email accounts their names, and names do change. Marriages, transfolk, etc.
- abeppu 3y agoI think there are _two_ primary issues with email addresses being used as a core part of account definitions. The one emphasized here is that email addresses change, but the other is that the user is giving every service provider they have an account with a _shareable/leakable_ form of contact info, which cannot effectively be revoked. I wish we would move to a Permissioned Messaging Provider model, where a standardized API allows a user to issue tokens to specific parties to send messages, which is revocable, and where the user can control the destination and medium of those messages. You want your airline to be able to send you status updates about your flight? Great -- you can choose whether those messages arrive as emails, text messages, whatsapp messages, etc, and you can remove those permissions later if you like. Permissioned Messaging Providers will also change sometimes. I think a keybase-like mechanism could be used for asserting that you're the same person across two services, but knowledge that @user1@providerA is the same as @user2@providerB wouldn't allow anyone to send messages to either, since you still need a token (unlike announcing publicly that you're moving from myname@emailprovider.com to myname2@email2.net).
- andyjohnson0 3y agoSome sites (e.g. Amqzon) allow login with phone number and password. While a phone number isn't a good permanent identier either, I occasionally wonder: does this option exist because there are significant populations of net-using people who commonly have no email address? If there are, are there particular geographic or demographic groups where this is common? E.g. developing nations, millennials.
- direwolf20 3y agoPerhaps "Free speech, but don't be a dick." Left-wing nutsoes will be repelled by the blanket association of "free speech" with the right wing, and right-wing nutsoes will be repelled because they want to use their speech to be a dick.
- latency-guy2 3y agoI don't think the left are as nice as they think they are, with all the cannibalism talk or violent uprisings they claim are coming. Let's relax with the generalizations no one invited on the last day of the year.
- octacat 3y agoUsing email as internal ID... Where? Emails would change. Same with phone numbers. I've never seen it, it is usually lives in a column in the table and is used to login. But internal ids are UUIDs or integers in the relational DB. I've seen people use phone number as an ID, but it is bad for GDPR and privacy reasons... I've seen people use incrementing ID and expose it to the user inside URLs (leaking the account registration time and the total number of users).
- noman-land 3y agoEmail addresses suck. All these "identities" that we use are owned by other people and are rented or "given" to us for use. Every single one! Email address, phone number, all social media handles, even IP address, even government identifiers. None of them are owned by you. As far as I can tell, the only way to have an actually good identifier is for a user to generate a public/private keypair. Yes, there are challenges with account recovery but we have tools for that like multisig and and n of m schemes and a bunch of other stuff I don't know about. Email is digital post cards handed off between two dozen untrusted couriers. Why on earth are we overloading this tool for identity, notifications, conversations, subscriptions, etc?
- supernova87a 3y agoPlease tell that to Github, where I first created my most simple/straightforward named account (very similar to my real name) using my company's email address. Company folded. Now I can never get my simple named Github name back.
- diogenescynic 3y agoI don't like using email as an identifier because I never know when/how Google could just arbitrarily delete my account. I've looked into alternative email providers but none seem to offer a customer support number where you can actually speak to a human. If anyone knows of one, let me know!!
- Eavolution 3y agoI liked Discord's solution of chosen name + short identifier, although I might have changed 4 numbers to 5 base64 digits, because no matter what the username, over a billion people trying to use the same name is unlikely, and 5 base64 digits can still be shared easily.
- ddejohn 3y agoI too liked this approach, and was annoyed when they deprecated it.
- kjuulh 3y agoThe only good identifier is a private one. Email, usernames, etc. They should all be changeable. You don't know what laws come unto function, which events occur, does a person change gender and now need a new social security number, did a person use a business email account for all their private stuff. Usernames change as we fancy, and the whole uniqueness around usernames are a little bit silly as well. A private id is probably just the best, whether it is a UUID, or another type of sufficiently collision resistant id, kept away from the user for the most part. Let said person have an email or username, and let other people tag or friend them, but only use said username/email when doing the initial connection. Base said connections off of, the private id
- calibas 3y agoThere's two separate but related issues that the article and comments here are merging together: identification & authentication The problem of identification, which is assigning a unique identity to each human being, has pretty much been solved. You have names, emails, id cards, really any unique string or number that's tied to a human being. It's not flawless, but in theory it works. The real issue is authenticating an identity, how do you know the person is actually who they claim to be? This is one of the biggest issues facing modern technology, and it has not been solved. We generally use a combination of passwords, geolocation, IP addresses, emails, phone numbers, security tokens and certificates to create systems that are "good enough". However, these systems are regularly breached, and tightening their security generally has a negative effect on legitimate users.
- niuzeta 3y agoWhat does the famous saying in the first paragraph actually say? The phrase is hyperlinked, and it 404s for me: https://regex.info/blog/2006-09-15/247 https://regex.info/blog/2006-09-15/247 It's quite odd to see a dead link from a post made literally today.
- Sniffnoy 3y agoHm -- for some reason it 404s when accessed via HTTPS. The link in the original post is a straight HTTP link, but I guess you have something that's turning it into HTTPS instead. Anyway it works just fine when accessed via straight HTTP. Obviously the site regex.info should fix that though, 404ing on HTTPs is obviously not what it should be doing! Edit: Oh right, you asked what the famous saying actually says. Since you're apparently not familiar with it, it's a joke of the following form: > Some people, when confronted with a problem, think "I know, I'll use regular expressions." Now they have two problems. Here, obviously, it's being applied to something other than regular expressions, but this sort of thing is what "now you have two problems" refers to. The actual linked article is looking into the origins of this joke.
- niuzeta 3y agoOh! That's very curious. Yep, tried to access using http and voila, it worked! > Some people, when confronted with a problem, think "I know, I'll use regular expressions." Now they have two problems. Ah! I remember this saying. Now I get it. Thank you!
- linsomniac 3y agoWhat if: We had support for public key e-mail addresses, something like <pk-12345@gmail.com>. But also <pk-12345@hotmail.com>. With online services treating them both as equivalent, so I could login or do account recovery with one after signing up with the other. Google bans me or hotmail goes out of business, and I can go to the other service and authenticate with my private key to open the same account there. Obviously, we'd want some sort of aliasing process so we can have a convenient name, but we probably want mail clients to map those addresses or at least track them with their public key. Could even end up being a shoehorn for E2E encrypted e-mail, which never really seems to have caught on in any big way. This would require some big players to support it to get anywhere, but from a brief thinking about it, it seems solid. Other than that nobody has support for it yet...
- friendly-user 3y agoI am surprised with this thread on hacker news no one has mentioned the decentralized identity foundation - https://identity.foundation/ https://identity.foundation/ There are efforts underway to create new ways of identifying and communicating via web where you own your identity, and are not depending on a provider or central authority.
- lostlogin 3y agoI once got dragged into a saga where a colleague had their ISP go out of business. So they tried to change their email address that was their username (is that the right term?) for Apple’s online services. It was carnage. You can still hit the rough edges of iCloud fairly easily, but 10+ years ago the edges were pointy and savage.
- elendee 3y agoI think one level of abstraction up, this is about whether to use externally meaningful (emails, etc) or internally meaningful ones (INT id's, etc). The specter of having a "permanent ID" (contextless), is something which has never really existed nor ever will. Identity only exists in context to some environment, even in blockchain.
- westurner 3y agore: ORCID, schema.org/Person and schema.org/identifier, W3C DID: Decentralized Identifiers: https://news.ycombinator.com/item?id=28701355 https://news.ycombinator.com/item?id=28701355 : > DIDs can replace ORCIDs - which you can also just generate a new one of - for academics seeking to group their ScholarlyArticles by a better identifier than a transient university email address. DIDs are typically (or always) the public key part of a public/private (asymmetric) keypair. > When would a DID be a better choice than a UUID? [or an email address]
- mcv 3y agoI once was the third person of my firstname, lastname combination at a company, so I got firstname.lastname02@company as email address. At some point I was in contact with an admin who noticed that the original firstname.lastname@company wasn't working there anymore, so he thought he'd be nice and give me that email address now. That was a terrible idea. Apparently, the original firstname.lastname was watching a couple of Confluence pages so he'd be notified when they changed. Those emails went nowhere because the address didn't exist anymore. But now it suddenly did again, so I started to receive all those notifications. I visited those pages to see if I could turn the notifications off, but they were controlled by the original guy's Confluence account, which I had no access to of course.