4 ms·
Also, quit asking for a username when I go to recover my password. My email address should be sufficient.
by insickness 13y ago
Also, quit asking for a username when I go to recover my password. My email address should be sufficient.
- xofer 13y agoThere's a major problem with this: privacy. The password process needs to prevent against discovering that someone else has an account. The way to do this is to respond exactly the same way whether the account exists or not. Less user friendly, yes.
- ComputerGuru 13y agoI used to say the same, and was a staunch advocate of that. However, it was pointed out to me that virtually every. single. website. that does this still leaks that self-same info during registration: i.e. what do you do on your site to prevent "existing account discovery" when someone tries to sign up with an email address that one of your users already has?
- xofer 13y agoLet an existing user register as a new user, send an activation email and update the account with the new info (if changed) if they re-activate.
- bluedevil2k 13y agoEmails should be your username - 1 less thing to ask them for in the sign up process.
- Ecio78 13y agook, BUT in this case you need to give a way to change your username keeping your user profile/history etc..
- alok-g 13y agoI presume authentication (at least currently) is not an important issue for unsubscribing. For example, bad people are not unsubscribing users from their competition as yet...
- pekk 13y agoYes, but if you want to derail people who are attempting to unsubscribe, this is a great way to do that. "Just trying to protect our customers"