211–220 of 289 posts
Earlier quoted context omitted.
You are also trusting the Oauth provider to never login as you for their own inscrutable purposes.
That is true. But then many people put a lot of trust in the major providers in many other areas too, such as hosting their private files and email, holding card payment information, and so on.
Earlier quoted context omitted.
These are not good examples of everyday websites. Southwest Airlines knows an awful lot more information about you than you provide them. They don't need your email address because they know who you are - and they make it your responsibility to monitor changes to your schedule/flight. Dominos Pizza allows you to monitor in real time the status of your delivery on their website after checkout. You can provide an email…
> The reality is, most regular sites do need a reliable way to contact you for business reasons. In these cases, which I think are more unusual than usual, a email can be required during checkout. There's almost never a valid reason to require a confirmed email account during account creation, before the user has even decided if they want to make a purchase.
Buying something online or subscribing to a service? The company does need a way to contact you... which is going to be email.
Email addresses are more-or-less globally unique, which makes them very handy for identifying an individual customer. Verifying the email address is an extra step that can provide the business with more confidence when dealing with a new potential customer. Certain types of fraud vanish or are greatly impeded with email verification, such as carding attacks. Customer support tasks can be performed more reliably and with identity confidence of who they are dealing with, stopping account impersonation attacks and more.
With all that said, sites that choose not to verify email addresses put a greater burden onto the customer for support needs. Password resets, order tracking, cancelling subscriptions etc. all become more difficult if the email address entered by the customer had a type-o for example, or belongs to someone else.
That doesn't mean all sites should verify email addresses - but it does mean railing against any site that does is misguided.
Earlier quoted context omitted.
You might not know if you have an account, and you might not remember your password. The solution to either problem is the same: send an email. So why not merge the two processes? Actually, any "forgot username/password" link effectively does this already. The only thing we need to do is make that more obvious. I think the easiest way would be to separate username creation from password creation. Just have a single s…
It's not a solution to the problem I described, if it were the forgot password page would already solve it.
That's the only part of your description I can see that I didn't account for. For any of this to work, the email must be sent quickly.
Earlier quoted context omitted.
The vast majority of the time the number one priority is reducing friction before a conversion. As much as a email confirmation prior to completion is more secure, the business case is far less strong. Customers can fix their email later, they can contact customer support if they got something wrong. Get them in the door ASAP, and either using the account, or complete an order. Don't redirect them to their email wher…
If reducing friction is the priority, then maybe skip email completely. Let people sign up with any username and don't require an email at all, like HN allows. Most sites that require an email don't need an email, and only ask for it so they can spam users with nonsense like product updates.
Earlier quoted context omitted.
That works fine till you have the access to your password manager. If you ever find yourself without it... imagine your Apple device got broken/stolen. You would be fine wihtout an ability to talk on some forum, but what about critical banking, e-gov sites?
My passwords are synced between all of my devices - iPad, iPhone, and Mac. Even if I lost all of my devices, I could walk into a store, buy a new device and log in and all of my passwords with be in sync.
> 99.9% of websites on the Internet will only let you create one account for each email address. So if you want to see if an email address has an account, try signing up for a new account with the same email address. This is not true if the signup flow is implemented correctly. Signing up for an account should always respond with the same message "we sent an email for you to confirm your account signup". The owner of…
The vast majority of the time the number one priority is reducing friction before a conversion. As much as a email confirmation prior to completion is more secure, the business case is far less strong. Customers can fix their email later, they can contact customer support if they got something wrong. Get them in the door ASAP, and either using the account, or complete an order. Don't redirect them to their email wher…
And don't get me started when the PM starts lowering friction to the point where they are basically trying to trick the user.
Earlier quoted context omitted.
It's not a solution to the problem I described, if it were the forgot password page would already solve it.
> it often takes 10 minutes for them to send a reset email That's the only part of your description I can see that I didn't account for. For any of this to work, the email must be sent quickly.
"No account for this email"
"Yes, there is an account for this email but it'll become apparent much later"
And your website might send emails fast, but that won't solve the issue because as a user I don't know if your website is fast or slow, so if I'm not registered with the email I entered, I'll see no email in my inbox and I'll have to assume it's one of the slow websites and wait 10 minutes refreshing to be sure.
That's why as a user I use the sign-up form to check if I already have an account instantly, and I'd be dissatisfied by an email-based system.
I guess it's for the website admins to weigh ease of use against security, but I feel often using email worsens the U.X in a way that's not justified by the security benefits.
Captchas, timeouts and rate limits are all well and good, but given the attack tools (eg: SentryMBA, OpenBullet) used by the lowest common denominator solve for those (by using captcha API's and residential proxy networks)... Breaking user enumeration vectors becomes super useful.
Earlier quoted context omitted.
My passwords are synced between all of my devices - iPad, iPhone, and Mac. Even if I lost all of my devices, I could walk into a store, buy a new device and log in and all of my passwords with be in sync.
In 3rd world countries that would be a whole different story...
Earlier quoted context omitted.
> The reality is, most regular sites do need a reliable way to contact you for business reasons. In these cases, which I think are more unusual than usual, a email can be required during checkout. There's almost never a valid reason to require a confirmed email account during account creation, before the user has even decided if they want to make a purchase.
We might be envisioning very different types of websites then. Some random dude's blog - no you don't need to enter your email address. Buying something online or subscribing to a service? The company does need a way to contact you... which is going to be email. Email addresses are more-or-less globally unique, which makes them very handy for identifying an individual customer. Verifying the email address is an extra…