Usernames: allow, require, or forbid users to user their email address as a username?

Re:Usernames: allow, require, or forbid users to user their ... by febeling on Wednesday May 09, 2007 @11:20AM (#20783)

i really like it when it is the email address. then it is never taken, and i don't have to remember which one of my usual username variations i have to put in.

when it is the the mail address, this makes a strong case for also validating them, otherwise people can accidentally lock up other peoples address by misspelling their own mail address. i think a user will never switch mail accounts to get access to a site. and as the customer service person you will be reluctant to delete a stale account from a misspelling, only because somebody claims his address is blocked. so you better know in advance this cannot happen.

[ Parent | on HN ]

Re:Usernames: allow, require, or forbid users to user their ... by brianmckenzie on Wednesday May 09, 2007 @01:19PM (#20817)

If you ever get into a situation where your site has over 50k users or so, you will see banned users switch email addresses to circumvent your security measures several times a day. I know I do, and my site only has 300k users.

The solution is to store banned IP's in your database, excluding massively-shared IP's like AOL, and check against this list during registration. I also keep a list of free proxies and prohibit people using those IP's from signing up.

[ Parent | on HN ]

Re:Usernames: allow, require, or forbid users to user their ... by febeling on Wednesday May 09, 2007 @03:40PM (#20851)

i was not talking about security, but about usability.

[ Parent | on HN ]