Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Removing email registration improved retention

solitaired.com

Post reply on HN
Print view View original

151–160 of 180 posts

Re: Removing email registration improved retention

#151

Post by tgsovlerkhgsel »

kwanbix wrote: post #83
Nextgrid wrote: post #71

Earlier quoted context omitted.

I agree that this is a core feature. However, the GDPR mandates that consent should be opt-in, granular (you can provide consent for your data to be used for one purpose but not another) and you can't refuse service because a user is refusing to consent to non-essential data processing (ads would fall into that). So yes, technically you can ask the user for consent, but it has to be explicit ("we'd like to share your…

But you are not sharing your email with fb. The user already shared it with fb. I am only telling fb, if you have this user with this email, show him an ad. I really don't see the problem. Much better a targeted ad than ads about porn, casinos, viagra or poker.

The German DPAs have a FAQ on this topic, and they're very clear about the fact that hashing isn't anonymization and doesn't change the fact that you're sharing PII. (The FAQ also mentions that you need consent and can't claim "legitimate interest").

Re: Removing email registration improved retention

#153

Post by ohyeshedid »

londons_explore wrote: post #19
ghaff wrote: post #4

Earlier quoted context omitted.

He does mention, somewhat off-handedly, that the lack of email makes password recovery harder. (Presumably impossible without some other communications channel like a phone number.) And you really need to be able to recover account access for a paid subscription. It's probably also reasonable to assume that if someone is going to give you a credit card number and address, they're probably OK with giving you an email.

I run a site that takes payments for a subscription, but then just stores a cookie on the users machine proving they've paid. It will give them the cookie again if they re-visit from any IP they've previously used. It also re-gives them the cookie if they try to pay again with the same credit card. Support just tells people to try to resubscribe if their subscription has 'vanished' - but it seems to happen to very fe…

Public IP as an auth token seems like a horrible idea.

You're giving anyone on CGNat or even the same coffee shop access to your customers account.

Re: Removing email registration improved retention

#154

Post by raverbashing »

icedchai wrote: post #72
Nextgrid wrote: post #65

Earlier quoted context omitted.

> you target Facebook/Google ads specifically at that email address That is scummy as hell and might even get you in trouble when it comes to the GDPR if you're operating in the EU. If I sign up for your web service the last thing I want is Facebook/Google knowing that fact.

Ask yourself this: Would you rather have targeted ads, for something you might be interested in, or completely random junk you couldn't care less about? Targeted advertising benefits both you and the advertiser.

Ah yes that's why Amazon suggests me several other phone models. After I just purchased a new phone. From them.

Re: Removing email registration improved retention

#155

Post by gingerlime »

tgsovlerkhgsel wrote: post #151
kwanbix wrote: post #83

Earlier quoted context omitted.

But you are not sharing your email with fb. The user already shared it with fb. I am only telling fb, if you have this user with this email, show him an ad. I really don't see the problem. Much better a targeted ad than ads about porn, casinos, viagra or poker.

The German DPAs have a FAQ on this topic, and they're very clear about the fact that hashing isn't anonymization and doesn't change the fact that you're sharing PII. (The FAQ also mentions that you need consent and can't claim "legitimate interest").

Thanks for that. Would you be able to link/quote the relevant section? I'm personally interested in it, but my German language skills are extremely limited.

Re: Removing email registration improved retention

#156

Post by gingerlime »

buzzert wrote: post #130
spsful wrote: post #92

>you can target them on Quora, Reddit etc as well. This is one of the reasons I stopped giving out my primary email address for user signups. I use a service called Blur which allows for unlimited "masked" emails to be created, allowing me to give companies read-only email addresses. In the four years I've had it I have created 378 email addresses. If I'm including the email addresses that I've already deleted, the l…

I registered a domain name that’s basically just a UUID, and pointed it’s MX records to my self-hosted email server (you could also point it to Google Apps or Fastmail). Everything before the UUID domain is just the name of the service, so something like hackernews@e913ff00...xyz. If someone sells out my email address, I can instantly burn it by just adding a sieve rule since they’re all unique. I even know who sold…

I'm using a similar technique, but rather generating a random address @my-domain.

To know which provider it was (in case I later get spam from somewhere else), I keep a text-file + email myself any time a new forwarder is set up, so this way I can always look up which service it was.

This way, I was able to spot a leak at box.com and maybe a couple of other places, before it was even announced.

Re: Removing email registration improved retention

#157

Post by gingerlime »

hinkley wrote: post #137
mceachen wrote: post #122

Earlier quoted context omitted.

If you're using gmail, plus-suffixing is a low-effort but effective countermeasure: username+servicename@gmail.com gets delivered to username@gmail.com.

I have about a 20% failure rate where email address validation fields reject the + character

and knowing it's gmail, it's trivial now for the company to simply drop the +... part and store/use your real email address.

Re: Removing email registration improved retention

#158

Post by londons_explore »

ohyeshedid wrote: post #153
londons_explore wrote: post #19

Earlier quoted context omitted.

I run a site that takes payments for a subscription, but then just stores a cookie on the users machine proving they've paid. It will give them the cookie again if they re-visit from any IP they've previously used. It also re-gives them the cookie if they try to pay again with the same credit card. Support just tells people to try to resubscribe if their subscription has 'vanished' - but it seems to happen to very fe…

Public IP as an auth token seems like a horrible idea. You're giving anyone on CGNat or even the same coffee shop access to your customers account.

In my case, customers don't have any data on the account - it's simply a bit saying 'has paid for premium?'. And if I end up giving premium to a few people who didn't pay it isn't an issue. The sign-up friction of needing an email address is greater.

Re: Removing email registration improved retention

#159

Post by GoblinSlayer »

Silhouette wrote: post #126
Nextgrid wrote: post #80

Earlier quoted context omitted.

A legalese wall or a banner saying "by using this site you agree to ..." is not GDPR-compliant anyway: https://ico.org.uk/for-organisations/guide-to-data-protectio... Under the GDPR, any non-essential data processing (analytics, ads, marketing, etc falls into that) should be opt-in and dark patterns like pre-ticked checkboxes are not allowed.

Under the GDPR, any non-essential data processing (analytics, ads, marketing, etc falls into that) should be opt-in This isn't strictly true. Consent is only one lawful basis for processing under GDPR, and it comes with a lot of strings attached that other bases don't necessarily have, which is why so many lawyers and consultants were recommending against relying it unless it was the only way during the mad rush to G…

That's the problem, that spam is business interest, not the customer interest.

Re: Removing email registration improved retention

#160

Post by rbecker »

gnicholas wrote: post #120
icedchai wrote: post #72

Earlier quoted context omitted.

Ask yourself this: Would you rather have targeted ads, for something you might be interested in, or completely random junk you couldn't care less about? Targeted advertising benefits both you and the advertiser.

This is a superficial view that does not account for the advertiser's ability to price discriminate via advertising. For example, say there is a Batman movie coming out, and I sign up on the Batman website to find out when/how it is released. The movie folks now know that I am very interested in this movie. They can choose to target me for a small coupon advertisement, knowing that I will likely claim it and consider…

With e-commerce, the coupon bit will soon be unnecessary - you'll just see higher "personalized" prices, with no indication that they differ from what others see. Like a more targeted version of https://crow.app/blog/price-localization-with-stripe
Post reply on HN