3 ms·

I would, but the whole purpose of this is to not tie any information back to a person, aka keep it anonymous. Persona accounts use email, so there's no point in

• yeukhon 13y ago
  Well, if you think people are going to create another username and another password to hide identity, that assumption is bad as well. You can launch a study and you will find even a lot of the "hackers" here will get lazy at creating a new password and a new username. You probably feel the same anyway. There is a whole bag of reasons why we don't want to reinvent an auth system anymore other than recording the username and give a user privilege/level to that name in the database. and with server logging, you have to do a lot of work to ensure your server isn;t logging ip addresses which effectively makes certain types of debugging and defense very difficult (intrusion detection for example). You also have to be aware of ISP logging as well. In the end, no, you can't guarnatee no one can know the identity.That philosphy is flaw. You goal is to ensure auth is as minimal as possible, and maximize security of information retrieval and storage. if you want to reduce the abiilty to know the user idetntify without a raintable / bruteforce, hash the identity. hash the username / email address. That's the only way to hide it from an obvious search.