3 ms·
Not sure you guys disagree! The parent said, "Maybe you don't display it as an "account", but I can't think of a single commercial website where you shouldn't
by kanamekun 12y ago
Not sure you guys disagree! The parent said, "Maybe you don't display it as an "account", but I can't think of a single commercial website where you shouldn't at least be taking an email address as part of the transaction."
Then #3 on the bulleted list of six points says, "Username = Email. Don't make people remember a username for your site. You may allow them to pick a username later on that can be used in lieu of their email address, e.g. as the URL for a profile page, but don't force them to use a username to log in."
- timr 12y agoThe quoted list is under "and if you do offer accounts..." on the blog post, and that's totally, utterly wrong for many sites. So yeah, if the OP thinks this advice is good enough to merit a verification badge, we disagree. The advice is bad. It can make all the sense in the world to make "accounts" a very lightweight thing. But if you're taking payments or doing anything that might conceivably result in a user support request (e.g. storing user data or taking some action on their behalf), then you need to have some form of registration. And once you have registration, you'll need to have some way to prevent drive-by registration by total strangers -- otherwise you'll start getting complaints from people that some jerk/spammer signed them up for your site. There are reasons that this stuff exists, and authentication always deserves careful thought.