Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Removing email registration improved retention

solitaired.com

Post reply on HN
Print view View original

101–110 of 180 posts

Re: Removing email registration improved retention

#101

Post by dheera »

Nextgrid wrote: post #65
threeseed wrote: post #64

This is not advice any startup should ever listen to. The most successful and lucrative form of marketing, by far, is re-marketing. That is where you take someone who signed up but is not currently a customer and you target Facebook/Google ads specifically at that email address. I've seen conversion rates as high as 30% and it's typically pretty affordable. It's such a critical part of marketing that many companies w…

> you target Facebook/Google ads specifically at that email address That is scummy as hell and might even get you in trouble when it comes to the GDPR if you're operating in the EU. If I sign up for your web service the last thing I want is Facebook/Google knowing that fact.

Agreed. If I feel violated or tracked, I'm far more likely to develop negative feelings for your product. If Facebook starts showing me more ads for your product right after I visited your site, you're definitely not getting my business.

Re: Removing email registration improved retention

#102

Post by matheusmoreira »

threeseed wrote: post #98
Nextgrid wrote: post #86

Earlier quoted context omitted.

Criminal gangs could also say that crime such as theft, robbery, blackmail, extortion, etc works for them and makes them money. It doesn't mean we should be legitimizing and encouraging this behavior that most of us agree is detrimental to society.

I think you need to calm down with the rhetoric. Criminal activities hurt people. Ads do not. Especially in this case where PII data is not being provided to the advertising company.

> Ads do not.

They do. Advertising's whole purpose is to manipulate people into doing what companies want them to do. Not every company has your best interests in mind. Due to this inherent conflict of interest, ads should be viewed with healthy suspicion at best.

Banning tobacco ads helped reduce smoking in my country. We should ban a whole lot more.

Re: Removing email registration improved retention

#103

Post by nefariousoctopi »

threeseed wrote: post #70
Nextgrid wrote: post #65

Earlier quoted context omitted.

> you target Facebook/Google ads specifically at that email address That is scummy as hell and might even get you in trouble when it comes to the GDPR if you're operating in the EU. If I sign up for your web service the last thing I want is Facebook/Google knowing that fact.

This is a core feature of every ad platform I've seen and is absolutely not a violation of the GPDR since users are giving consent when they signup. You've signed up for a web service and never seen ads on other sites for it ? Very strange.

> This is a core feature of every ad platform I've seen and is absolutely not a violation of the GPDR.

I agree with you on this part. It is not a violation of GDPR on the ad platform side since you, as the data controller, are responsible to obtain a permission from the end-user. The ad platform is a data processor defined under GDPR. I am sure that the agreement between you and the ad platform is stating that you have a permission to use the email addresses for targeted advertising purposes and bear the full legal responsibility if not.

> since users are giving consent when they signup.

See Nextgrids comment. Yes, the GDPR admittedly lacks on the enforcement side and yes, I agree that this is a common practice, but that does not make it legal. Not for a data subject residing in the EU.

Re: Removing email registration improved retention

#104

Post by c22 »

dane-pgp wrote: post #76
c22 wrote: post #33

Earlier quoted context omitted.

I ran a small system for awhile where you could designate three other users to act as backup. If you needed to reset your password each of the three backups would receive a unique token and a request that they forward it to you out of band. With all three tokens you could reset your password. This was optional, though, and in addition to a classic email based reset flow. Obviously a solution like this would only real…

Could you set a minimum amount of time since last login / visit before recovery was possible? If you are visiting the site every day, and your three "friends" decide to collude to reset your password, the site should refuse to issue the tokens since you are still able to access it. This gets a little more tricky if you have an unexpired session but want to be able to change your password (which likely requires knowin…

The community as a whole was pretty tight-knit so we didn't go that far down the security rabbit-hole. The initial proposal, though, only required a single backup and we did increase it to 3 to add a little more defense ;)

Presumably if only one "friend" defects and attempts to reset your account you will be notified by the other two friends sending you unrequested reset tokens out of the blue

3 is kinda an arbitrary number, chosen to strike a balance between security and convenience. It was decided that getting 3 people to collude to erode the trust of the community was harder than intercepting an email so the solution was accepted as adding some additional amount of security.

Honestly a bigger flaw in this scheme is if one or more of your friends is no longer active or has forgotten their own password and cyclically is relying on you for backup. You can hedge against this a bit by adding more backups and requiring only some critical mass of tokens, but this does also increase the attack surface.

Re: Removing email registration improved retention

#105

Post by elorant »

spsful wrote: post #92

>you can target them on Quora, Reddit etc as well. This is one of the reasons I stopped giving out my primary email address for user signups. I use a service called Blur which allows for unlimited "masked" emails to be created, allowing me to give companies read-only email addresses. In the four years I've had it I have created 378 email addresses. If I'm including the email addresses that I've already deleted, the l…

Care to provide a link for the service you're using?

Re: Removing email registration improved retention

#106

Post by Nextgrid »

threeseed wrote: post #98
Nextgrid wrote: post #86

Earlier quoted context omitted.

Criminal gangs could also say that crime such as theft, robbery, blackmail, extortion, etc works for them and makes them money. It doesn't mean we should be legitimizing and encouraging this behavior that most of us agree is detrimental to society.

I think you need to calm down with the rhetoric. Criminal activities hurt people. Ads do not. Especially in this case where PII data is not being provided to the advertising company.

> Ads do not.

There are plenty of scams and malware being spread through ads. Furthermore ads are a parasite that wastes most people's time for no benefit with no official way for them to opt-out (a lot of services don't allow you to pay money to opt-out); it'a a cancer on society.

> Especially in this case where PII data is not being provided to the advertising company.

You are literally talking about capturing e-mail addresses so you can pass them to an advertising partner to target ads to these users. How is that not PII?

Re: Removing email registration improved retention

#107

Post by icedchai »

Nextgrid wrote: post #85
icedchai wrote: post #82

Earlier quoted context omitted.

If you feel it's a liability, it is up to you to protect yourself. Use VPNs, disposable VMs, multiple email accounts, private browsing, and whatever else you think is necessary to preserve your privacy. "Tracking" is baked in to the web. The cat is out of the bag. No advertising isn't a viable option in this world. I'd go as far as to say that the Internet, as we know it today, would not exist without targeted ads.

In this case you could say that we need to go back to the Middle Ages and we don't need laws & enforcement and if you are concerned about getting robbed or killed it's up to you to defend yourself by wearing body armor, carrying weapons and having your own personal army. Society has laws for a reason when its constituents decide that certain behavior is detrimental to it and should be outlawed & discouraged by the us…

The difference is enforcement. GDPR cannot be enforced worldwide. Even if it "legally" can, which is debatable, practical enforcement is another matter. Even if it could be practically enforced, accidents happen. People make mistakes. Your data could still be shared with a third party due to a bug or just plain incompetence. It's still a good idea to protect yourself.

Re: Removing email registration improved retention

#108

Post by icedchai »

kop316 wrote: post #97
icedchai wrote: post #72

Earlier quoted context omitted.

Ask yourself this: Would you rather have targeted ads, for something you might be interested in, or completely random junk you couldn't care less about? Targeted advertising benefits both you and the advertiser.

I do get targeted ads, it's called newletters I sign up for on services, and blogs of techincal companies I keep up with. Both work well for things I am interested in. As yourself this: How do you feel about the possibility of any personal information you give to any company may be given to others without your consent (or "with your consent" behind a huge wall of "this is how we use your data, take it or leave it"),…

I am fine with pseudo-anonymous ad targeting. You can collect personal "interests" without collecting truly identifying PII.

However, what you describe already happens and has for decades, in the offline world. Tons of personal info, like real estate and voter records, are already public in many jurisdictions anyway. Insurance companies, credit card companies, phone companies, and everyone else all take this stuff and spam the hell out of everyone.

Re: Removing email registration improved retention

#109

Post by icedchai »

Nextgrid wrote: post #106
threeseed wrote: post #98

Earlier quoted context omitted.

I think you need to calm down with the rhetoric. Criminal activities hurt people. Ads do not. Especially in this case where PII data is not being provided to the advertising company.

> Ads do not. There are plenty of scams and malware being spread through ads. Furthermore ads are a parasite that wastes most people's time for no benefit with no official way for them to opt-out (a lot of services don't allow you to pay money to opt-out); it'a a cancer on society. > Especially in this case where PII data is not being provided to the advertising company. You are literally talking about capturing e-ma…

The emails can be hashed, turning it into a pseudo-anonymous ID. It is debatable whether that is PII. It probably comes down to whoever can afford the better legal representation.

Re: Removing email registration improved retention

#110

Post by feistypharit »

elorant wrote: post #105
spsful wrote: post #92

>you can target them on Quora, Reddit etc as well. This is one of the reasons I stopped giving out my primary email address for user signups. I use a service called Blur which allows for unlimited "masked" emails to be created, allowing me to give companies read-only email addresses. In the four years I've had it I have created 378 email addresses. If I'm including the email addresses that I've already deleted, the l…

Care to provide a link for the service you're using?

He means https://www.abine.com/. personally, I use https://33mail.com/. If you want to go full fake, check out https://mysudo.com/.
Post reply on HN