7 ms·

Why must apps require email? Why not only username and password?

• zetanor 10mo ago
  Because it's less expensive to send a few e-mails than to provide customer support to everyone who forgets their password.
• jgalt212 10mo ago
  I agree. username and password is much more robust to credential stuffing attacks.
  • gruez 10mo ago
    > username and password is much more robust to credential stuffing attacks. /s?
    • jgalt212 10mo ago
      tell me how it's not.
      • crazygringo 10mo ago
        You're the one who made the claim. So please explain how it is.
        • cxr 10mo ago
          Credential stuffing happens when a user signs up on one Website B with account information matching the information they used when setting up their account on Website A, and the operator of either Website A or Website B can use those credentials to access the user's account with the other operator. If websites authenticate with username and password combo chosen by the user, then credential stuffing is neutralized if the user avoids re-using the same combo, effected by the user selecting at least one of a different password or the selection of a different username. If instead of a username, an email address is required to register, that generally results in one less degree of freedom; rather than being able to create a username with Website B that differs from the username they created on Website A, absent the use of a wildcard/catch-all mailbox or forwarding service (which are not straightforward to set up, and almost nobody has one), the user is required to disclose an existing email address. (It also increases the surface area for attacks, since the malicious website, now knowing the user's email address, can attempt credential stuffing with the user's email provider itself.) You can balk at whether or not these are negligible differences, but it's non-zero. Therefore, all other things held equal, then strictly speaking it is more robust.
          • gruez 10mo ago
            >If instead of a username, an email address to register, that generally results in one less degree of freedom [...] It "generally" doesn't, because the average user isn't randomly generating usernames per-site, just like they're not randomly generating passwords per-site. If they're randomly generating usernames per site, they'll need some sort of system to keep track of it, which is 90% of the way to using a password manager (and therefore randomized passwords, immune to credential stuffing). For it to practically make a difference, you'd need someone who cares about security enough to randomize usernames, but for whatever reason doesn't care enough about security to randomize passwords.
            • cxr 10mo ago
              To start with, randomly generated usernames weren't mentioned, and they are not a prerequisite. > It "generally" doesn't, because the average user isn't randomly generating usernames per-site What other people do, whether average users or not, doesn't matter. When average user Alice is registering accounts on Websites A and B, the fact that average user Bob doesn't use different usernames for his accounts doesn't change the fact that if Alice would have otherwise registered account agirl on one site and pie_maker26 on the other, but instead has been forced to enter her email address, then that has a non-zero effect on risk. For the claim as stated to be untrue, the difference in risk would need to be zero.* But it isn't zero. The claim as stated is true. > For it to practically make a difference, you'd need someone who cares about […] That's not true. Users who are exposed to lower risk by accident are still exposed to lower risk. It's not a prerequisite for the user to care at all, nor does it require them to understand any of this or to be trying to adhere to any particular scheme to achieve a certain outcome. The only thing that matters is what they're doing—and whether what they're doing increases or decreases risk. Intent doesn't matter. * or it would need to be somehow less risky when email addresses are required in place of where a username otherwise would be, but that's not the case, either
              • gruez 10mo ago
                >To start with, randomly generated usernames weren't mentioned, and they are not a prerequisite. I've seen sites randomly generate passwords for users as well. Does that mean users reusing their passwords at all is a prerequisite? Moreover if we're really accepting "whether average users or not, doesn't matter", I can also say that using emails doesn't decrease security because you can use randomized emails, as others have mentioned. At some point you have to constrain yourself to realistic threat models, otherwise the conversation gets mired in lawyering over increasingly implausible scenarios. For instance, by asking for emails at registration, you can more easily perform 2fa, whereas you can't do that with only a username/password combination[1]. [1] before you jump to say "but can ask for an email with username/password too!", keep in mind the original claim that username/password is better was in response to a comment asking "Why must apps require email?".
      • apgwoz 10mo ago
        The onus is on you here… but, I think I know where you’re going with this. In terms of number of email addresses people have and use, vs number of usernames people have and use, you might be right that some people have 1 or 2 email addresses and many usernames. Email masking has become easier to use, and many people use `+addressing` to uniquely tie their email to the service for spam prevention / tracking, which would make stuffing harder. In these cases, email would be much more unique and a better protection against stuffing. HOWEVER, it’s not obvious how Email verification protocol would work for these types of things.
    • ashed96 10mo ago
      In theory, maybe to some extent yes - unique usernames could beat reused emails. But let's be real - nobody actually does that.
• tytho 10mo ago
  Many applications need a way to contact a user (security breach, password reset). If one only has a username and forgets the password, there’s no way to reverify the user.
  • l___l 10mo ago
    [dead]
  • Hizonner 10mo ago
    > If one only has a username and forgets the password, there’s no way to reverify the user. Tough beans?
    • crazygringo 10mo ago
      A good user experience does its best to avoid tough beans. That's kind of UX 101.
      • Hizonner 10mo ago
        Having your account taken over is also a bad user experience.
      • dspillett 10mo ago
        In the case of security procedures, I'd argue that there is some room for tough beans. Reducing security to cater for carelessness seems like a really bad compromise to me, one that I see far too often.
        • deleted 10mo ago
          [deleted]
        • tsimionescu 10mo ago
          This is an absurd position, and potentially illegal - for paid services. You have a business relationship between the company and a person. Whether that person remembers the password or not is immaterial to whether they have the legal right to anything they purchased in the app.
• ocdtrekkie 10mo ago
  Without traceability, any app that can be used for abuse will be. (An HN reader used an anonymous mail service to send me some hate speech and tell me to kill myself within the last day. The service they used to do it obviously does not care, but also cannot do anything about it, because they don't know who used their service to do it.)
• cynicalsecurity 10mo ago
  Because emails of real people can be sold to advertisers.
• hombre_fatal 10mo ago
  Most people want a way to recover their account if they lose those creds, especially when you ask them once they’ve lost their creds. It’s also a rudimentary PoW system against bots. And people who don’t want to share their email can use a temp email service, so it’s no skin off their back.
  • immibis 10mo ago
    So make it optional. I've seen sites like that. Bots have no trouble signing up with @mybotfarm.example addresses.
    • Levitz 10mo ago
      Ultimately this is akin to password requirements. They are a bother but the average user is just much too careless to be trusted with their own security.
  • defanor 10mo ago
    > And people who don’t want to share their email can use a temp email service, so it’s no skin off their back. That seems to be a better option for bots than for actual users: if you care about the account, you probably would not want to make its password resettable via a service like that. Or even via a regular email provider you do not trust, and those could easily be the only kind available.
• efilife 10mo ago
  Weird that no one said this yet: To verify users' legitimacy. If you make effort to block 10 minute email services it works kinda well and slows down bots
• charles_f 10mo ago
  * recover password * prevent signing up for someone else (validate it is you who owns the email) * poor man's mfa, although please allow me to use totp instead (probably the three most legitimate reasons from a user perspective, email validation prevent you from making a typo) * send ads and notifications (legitimate from the provider's perspective, they want campaigns to succeed, email validation makes them sure emails land) * reduce throw-away or bot accounts