I assume it's about tracking but now I'm beginning to suspect that it's simply a cargo cult mentality where no body asks why are we doing this.
I don't proceed with anything that requires a form to be filled without having a good reason. I'm actually positive that I have a bank account that doesn't have a login info, when I need to sign in from another device I would simply scan a barcode from the app to let me in.
Yet, there are apps asking me more questions than an immigration officer to let me use it.
But when it does go away (app reinstalls, phone upgrades, phone breaks etc), it causes a disproportionately catastrophic event: complete loss of access. Providing a simple email address would prevent this, but expecting the common user to have the wisdom on account recovery strategies is too optimistic. That's why many apps ask for email during registration.
That can be tolerable for Discord, because your loss is just your friends list and access to some servers, which can be recovered easily through social means. That's not possible or feasible for every kind of app.
Discord basically copied IRC and added voice chat. One didn't need an account for IRC why should they need one on Discord? Maybe to retain their nickname but that's it. And it was just a password, no email no phone number no nothing else.
I really liked the temporary and anarchic nature of IRC. No one was really in control.
The next logical step would have been to make it encrypted and add p2p voice chat via DCC or some other method. SILC tried the former but failed to gain traction, people either stuck with IRC or moved on to AIM and Yahoo Messaneger.
You can easily offer an optional data safeguard feature for account restoration.
This is especially pronounced now that application sync between devices is more or less universal on iOS and (to a lesser extent) Android.
To the layman, the intuitive perspective is that it "just works" and is exactly how they left it previously, regardless of whether they have wiped their phone or replaced it. This isn't a dig at tech illiterate people but it is just how things are for the normal person. Hell I have been almost burned by this in the past when I moved phones and a certain app(FGO)'s data didn't transfer over.
TLDR The most intuitive thing is working out of the box and seamlessly transferring to a new device. The easiest way to do this is to allow it to be bound to a user's Google account, Microsoft account, and Apple ID.
Those little security-by-securing-all-handset mechanisms kind of worked while there weren’t any publicly known rooted phone, in the wild, that can establish a session on featurephone APN, but emergence of iPhone and Android extinguished it.
I know of at least one carrier, but is only usable for their own customer self care portals/apps. There it is possible to auto-login to their app if it is accessed via their network and not via Wi-Fi. For security reasons only a limited amount of functionality is accessible. Neither customer data can be changed nor can any actions resulting in additional cost (buying packs / options) be performed without additional authentication mechanism of a higher security level (auto-login via SMS or use of a password).
The MSISDN is only added to the HTTP request internally in their secure network and never exposed externally.
Like, have http://my.number/ return the phone number for identification (though it would need some permission, I don't want every app to have access to it).
Make a HTTP POST with some data to http://my.number/validate and have it signed by the carrier, validate it against a list of public keys per carrier. Not sure why that wouldn't work today? It could even be a private/reserved IP address routed by all carriers to their auth service.
Edit: obviously, it wouldn't work over Wi-Fi without some cooperation at the OS level.
The idea is that, they already created an account by launching your code, so you don’t have to ask for account creation. Just ask for the information that is necessary to run your services and you can provide an optional method for account recovery.
Probably better if the browser started to come with an e-mail set in it - then web admins can query for that and users have the option to change the email when they so choose...
So, the users who switch from iphone to an iphone don’t loose anything if they follow the default upgrade process.
Sounds great while iCloud is up/you use iOS...prepare for the shitestorm when its not or the user decides to leave Apple... 'Easy' and 'Convenient' won't be the terms anyone is using.
Give me a proper website with a proper email/password/WebAuthN & SSO signup. I don't want the app, I don't want any of it.
Websites are simply apps installed in the browser without asking for permission. Notorious for tracking abilities, data storage tied to the browser, performance lower, capabilities limited to browser api, data consumption unpredictable, identification tied to web technologies.
Some people may want just that, I don’t judge.
That actually work on the platforms I choose. There are many apps that only work on iOS/Android that I want to run on my desktop or a more pure linux phone. I just want to be able to consume a service from a platform that clearly have the technical capabilities to do so, but no, it has to be a "app".
> Notorious for tracking abilities
And a lot easier to chose/disable them. This summer many apps (including stuff like spotify) would not even start on iOS because the facebook SDK crashed. On the spotify web player I can choose to block calls to recaptcha, facebook and similar with umatrix. Do you think that apps on average have less tracking or just that you tend to pay for apps but not for webapps and therefore get higher quality apps?
> data storage tied to the browser
Great! Data storage on the client should either be treated as unreliable or the only storage (for stuff where there is no "cloud" or privacy is critical). Tying storage to a single vendor (like icloud or google drive) is a very, very bad idea. Web browsers also have a well defined interface for you to inspect the data saved locally if you want.
> performance lower
For the majority of apps this does not matter. The reason webapps are usually slow is not that the platform is slow, it's that companies copy websites that are stuffed with tracking (if you block that they tend to be much quicker). They suck because the people who made them made them suck.
Most chat, mail, news, or any other form of text/image/video app could easily be performant enough as a webapp. Hell, amazon even made their real time game streaming service a webapp. The platform is not the problem.
> data consumption unpredictable
Not sure what is different here from native apps? Both can auto-update, both can download assets at-will, right?
> identification tied to web technologies
Yes please! That means it's portable and not tied into google/apple!
A native app has every opportunity a webapp has to track you and much more.
> data storage tied to the browser
So? Browsers make it as easy to clear the storage of a webapp as it is to clear the storage of a native app. If you are talking about PC apps it is even easier to clear webapps' storage than native apps. If you mean it is bad because the stored data can disappear from the users device, that is what the localstorage API is for. Browsers will only delete that data if the user tells them to. This isn't any different from native apps having to deal with users deleting their files.
> Performance lower
While I have to admit that for raw computation webapps are slower than native, most apps don't need that much raw computational power and WASM should bridge the gap to native performance for apps that do need it. If your webapp is slow it is by far more likely you did a poor job programming it, not that you are limited by web performance.
> capabilities limited to browser api
Browser APIs are expanding all the time (except on iOS Safari but Apple has a vested interest in crippling webapps). And again, most apps don't need deep access to a system and the few that do shouldn't be webapps anyway.
> data consumption unpredictable
This has absolutely nothing to do with if an app is a webapp or native. Native apps can suck down data like crazy while webapps can use almost none and vice versa.
> identification tied to web technologies
Not really? Name one form of widely used identification that webapps don't support. You can use emails, usernames, 2FA, security fobs.
edit: remove snark at the end, it didn't add anything.
Nope, an iOS app can’t leave a cookie that other apps can use to identify me.
Clearing storage is not the issue, making sure that the storage is not accidentally cleaned is.
The data consumption of an app is predictable because the download size would be listed in the appstore. On a website, it could be anything and the only way to find out is to load it. You can check out the data usage after install in iOS but there’s no easy way to do it for websites.
Maybe not directly, but by using something like the Facebook SDK the same effect can be achieved by shipping your advertising identifier off to Facebook who then does the tracking server side using events generated by the Facebook SDK. This is in tons of apps and you have no way of knowing it as an end user without reading the privacy policy or reverse engineering the app.
> Clearing storage is not the issue, making sure that the storage is not accidentally cleaned is.
This is just as much of an issue on native apps as it is with webapps, browsers wont clear local storage for a website unless the user requests it just like how a native apps storage won't be cleared unless a user requests it.
> The data consumption of an app is predictable because the download size would be listed in the appstore. On a website, it could be anything and the only way to find out is to load it. You can check out the data usage after install in iOS but there’s no easy way to do it for websites.
Just because the App Store download size is predictable doesn't mean the final download size is, lots of apps download a bunch of extra assets on first launch or even regularly as you are using them. I also couldn't find a way to check data usage of apps or websites on WiFi on my iPad so that isn't really a point either way.
> - Advanced Persistent Device Identification: Identifies individual mobile devices for both iOS and Android platforms, even if they have been reset or if the application has been reinstalled.
> - verifies the integrity of the application in which it is embedded to ensure it has not been modified or infected. It also analyzes all other apps installed on the device, and reports their reputation and the presence of any malicious code.
There is no iOS API that allows them to do this. Apple removed it years ago: https://appleinsider.com/articles/15/06/24/apple-expanding-u...
Being able to know in what I am getting in and tapping install is much, much better experience than tapping on a link to the unknown then trying to figure out how to reach the thing I am looking for when the website tries to track me, monetize me, make me sign up all at the same time.
A website would usually load about the same size data of a native app without a warning and would report me to facebook, google and others.
That’s not something I am thrilled about.
Why do you think native apps are not like that?
Many apps load SDKs from google and (especially) facebook. They often load a lot of assets from servers.
For websites, this is not an option.
Option A: Only runs on one platform, can only be published on that platform with the blessing of the manufacturer of your device and little-to-no insight into data usage
Option B: Cross platform, can be interfaced with using open standards and block parts of it that you want (not just on a DNS level, but on a resource level)
I really don't see why you would prefer A?
If you’re building a service that’s not suitable for option A then you use option B. It’s not really a discussion at that point.
I’m glad that there’s an option B the way that I am glad that there’s frozen pizza in the fridge. Good to have it but I’m not gunning for it if a proper restaurant pizza is available.
There are a number of pseudo vpn like apps that give you similarish control over native apps just the same as an extension on a web browser that uses hostname blocklists.
I don't believe a website can upload your contact list, upload a list of apps on the device, log your GPS location or record using your camera or microphone. Is this no longer true?
Requires an opt-in permission on native, for browsers with support, it would also be an opt-in permission
> upload a list of apps on the device
Not possible on iOS for a native or web app. Depends on a number of factors on Android.
> log your GPS location or record using your camera or microphone.
Possible for native and web apps, but only after explicit opt-in permission.
End result, no meaningful difference between native and web for any of your examples.
True AFAIK.
> log your GPS location or record using your camera or microphone. Is this no longer true?
Depends on what you mean. This is fully possible on many phones and only needs approval from the user.
Then again approval from the user seems to be becoming the standard in installed apps as well.
That said, I much prefer web pages for things that need cloud or apps/desktop applications that works offline for the rest.
I don't know where you are, but in the US it is actually illegal for a bank to offer financial services without collecting a significant amount of personal data from the customer. This exists for a few reasons but I think the most significant one is that the government does not want to give up the ability to block financial transactions for those they deem unacceptable. (Like terrorists.)
It all makes sense, they are required to know me for AML reasons, so the account creation step collects this data.
The bank is mobile first, so the account is activated through the app when my card arrives. Why would I have a username and password for the app that is used to create the account in first place? The app can keep it for me without exposing it to me ever. I can’t be phished for something that I don’t know and it is one less password to remember or take care.
> Please don't post comments saying that HN is turning into Reddit. It's a semi-noob illusion, as old as the hills.
You then have to record a video selfie saying something like "I am NAME and I want to recover my account" and then send a pic of an ID. Same process (the selfie+ID part) for if you want to display your card PIN reminder.
As an occasional discord user: yes, exactly. That's how Discord syncs communities and read messages between my phone, tablet, and computer, either via app or web client.
This is a huge convenience over say IRC where (last time I looked) the way to get any client-side consistency is to run a personal 24/7 relay on your own server and use special clients to connect to that instead of the main IRC server.
Which is the setup equivalent of not wanting a Dropbox account because "you can already build such a system yourself quite trivially by getting an FTP account, mounting it locally with curlftpfs, and then using SVN or CVS on the mounted filesystem."
Why would I want every single thing I do online to be directly linked to one physical real world device?
It's not so much about data loss for me but I don't want anything real world linked to me to be used to authenticate me in any way other than monetary transactions or things with tangible physical value.
Other than that, I have a range of email addresses and usernames I use depending on the nature of the site and the amount of personal information i'm willing to disclose.
I have a fairly fine grained system for managing my user accounts accross various platforms and i'm personally finding it more and more aggravating the amount of places that require some kind of google or facebook sign in, let alone the idea that my phone should be my universal user account/name.
The internet should be like the rest of public life. For the most part, in my day to day life, I get to choose the amount of personally identifiable information I disclose to others. Managing multiple user accounts with differing levels of personal information is the internet equivalent of this.
I do not wish to be linked to one 'universal digital me' my real life interactions are not like that, why should my internet interactions be forced to be that way?
I have different groups of friends, acquaintances, coworkers etc. I don't act the same way with all of them, I don't talk about the same things with all of them, they don't all have the same level of information about my life, yet increasingly, online interactions are being pushed into this 'one you for everyone and everything' paradigm that is completely antithetical to the original values of the early internet and human interaction in general.
- The app is used on one device
- Only one user has access to a device
- There is a convenient or reliable way to identify a device for all platforms you target
Plenty of apps can live with those, and plenty can't. email address is one of the least bad ways to do it.
It might just be a matter of boilerplate. The permissions and usernames are (in code, in legalese, etc) may be tied to the concept of a signup. They might have investors, advisors or whatnot asking about weekly registration trends or somesuch. They may have a regulator, and the regulator assumes that you have info.
Even banks are increasingly getting regulator-ish. You may need to produce a "know-your-customer" policy.
Anonymity just isn't done anymore.
Passive voice alert! By whom? Site/app producers can, with certain exceptions, choose to allow anonymity.
That's an understatement, if I ever saw one.
> Anonymity just isn't done anymore.
When was banking anonymous? In the days of Bonnie and Clyde? :-)
what more are you typically putting in, other than an email address, maybe a username for uniqueness, etc...?
You can use firebase accounts to manage that. Start with the anonymous account which will create an account with a random UID and use the mechanism to convert the accounts into “registered”. Pretty easy, you don’t even have to create your own custom solution.
It's an app for our wearable (but our wearable is also optional, haha). As said: account is no longer required on iOS, but we are also working on that feature on Android as well.
This morning I left my daughter at home until noon. Not knowing how to stay in touch with her 'just run case', I tried to set up a Google Meet that I could join at work to see what she was up to.
Cue 15 minutes of:
- trying to create a meet without an account => fail.
- use my account to create a meet, take link, pull it up on daughter's computer.
- need to create account for daughter on Google so that she can join.
- creation of children account requires me to login because children not >18.
- create family with my account.
- back to creating account for child.
- strong password entered.
- google requires a payment setup, picks up my credit card (??) from my account to add to daughter's account.
- cannot dismiss payment option, stuck there..
Then I thought about Discord:
- Go to Discordapp.com
- Click on "open app", enter chilren first name, server is created
- copy paste link to my computer and go to children server
- Done
This is just fantastic. I just abhor the user story on anything else now, this is just so easy, and solves so many issues.
> Sure, you can make a brand new account, but that's easier said than done, because:
> 1) You can't be logged into two accounts at the same time on the desktop. You must use different browser profiles or a similar sandboxing method. Definitely out of the question for mobile.
> 2) No way to transfer your old servers, friends, roles, etc, to a new account.
> 3) Making a new account isn't always a reasonable option even if you are willing to lose all of your old data. Moving from one role to another to another in a gaming career often is done gradually through connections and community (but that doesn't imply you should have to be forced to expose your system username and user id to everyone everywhere).
> 4) Even if you do make a new account, that new account might get disabled automatically until you provide a phone number. Throwaway numbers don't work.
This is the Web experience at least, on mobile they presumably already have all of this (or the equivalents) right after installing their app.
EDIT: to add to this, I once created a Discord account associated with a fake e-mail. After a while they presumably figured that out, but instead of, e.g., letting me log in and change the e-mail, they just locked me out.
Go to discord.com right now, click "Open Discord in your browser", enter a random username, and hit enter.
But back then there was no official way to browse more or less public servers, which is the case now. I guess to join those it might be good enough in their eyes to just create a temporary account to let users test the waters and hopefully later convert into a proper account.
What are you talking about? I've tried to create an account before it and would not let me without giving them a non-voip phone number.
YMMV should be included in that statement.
https://support.discord.com/hc/user_images/p4prIch_rOOP4zr7M... German Picture: https://imgur.com/a/qYLf7On
so if you join servers with the default setting you won't be asked for anything. most bigger communities need a validated email tough.
That's how I ended up with three Discord accounts with no way to merge them and I am not alone [1].
[1] https://support.discord.com/hc/en-us/community/posts/3600531...
[0]I acknowledge that if you're in some private servers where inviting is disabled you might need mods to create an invite for your primary account
[1]I haven't tried to delete my discord account recently
Edit: this was for an invite on a server I control and allows unrestricted access. It is not a server requirement; it is a discord requirement.
Going for auth impacts everyone because you have to provide (and verify) your info to us, and this translates to 99% of the users being impacted by the other 1% who will not play by the rules. Sure, you can blame companies for not coming up with smarter options for eliminating the abusers that hurt everyone else, but when we're offering a free service without asking for anything back from your side I find it hard to justify investing months of development into this. And this is why you create an account with your email or phone number, and if you make the life hard for everyone else you go out of the platform and let everyone else enjoy it peacefully.
Maybe that was also because I started by signing up instead of following an invite link (not sure about that).
It will then bug you to "claim" your account (add e-mail address etc.), but you can already use discord normally.
I’m sure it is a pretty small percentage of users this impacts but I think confirming an email address as real before allowing access avoids this wasted sunk cost and probably more importantly to small communities, avoiding troll accounts/harassment.
curious why you didn't choose to charge a fee for registering an account in the end?
Are you monetizing the service in any way? I assume hosting files up to 20GB doesn't come for free right?
The process you described sounds super similar to the low friction involved with getting started on IRC!
Not for me. I was forced to give away my phone number to create an account.
I'm highly pleased with it. From all other platforms I've tried, Jitsi is the saner, offers more freedom and is more inclusive (no account needed). As an educator, platform inclusiveness ranks very high on my criteria for choosing which way to go.
While that's good, it would be better if they added an option to "log into an existing account".
I created 3 different discord accounts that way. There was no way to realize that I was creating a new account rather than just creating local name for an existing account.
I also want to add: you don't have to install a thing either. I played a few games that heavily encouraged community coordination and still remember people backing out of VOIP because of the download ("I'll do it when I log off" and then never do). In addition, because of a central API, users can be authenticated with in-game/game account info and automatically assigned a role, instead of sitting about waiting for an admin.
Discord removes every barrier of entry possible.
> to mailing lists that 97% of their users will find fucking annoying.
This lets you measure engagement. Discord trusted their product enough to know engagement would happen.
I don't remember the last time I joined a community or Slack where I had to enter a bunch of info, but I see in my Discord a bunch of servers I've joined because it is so easy.
Facebook is nobody's favorite platform and yet it's the one most people have.
In our student organizations (at university) we've settled on Teams, which is what's available through our university accounts. I'd guess most universities have an equivalent, but let me know if I'm wrong. This has the benefit of requiring no sign-up, and separating work and personal life.
If you're talking about HS students, then I'd be surprised to hear that they're unwilling to install your preferred chat app to join the program.
A. Nobody checks Slack. In the beginning everything's great and people are engaging on slack, but after a few weeks engagement drops off.
B. The number of people without Facebook has been precisely 1. If there were more people without FB accounts, I'd 100% consider another option.
C. Begrudging use is better than no use. It's not that students are boycotting my program because they have some hatred of Slack. It's more that they're confronted with a form, which they put off and then forget to do.
"Perfect is the enemy of good" -- you're making the right decision by focusing on good mentorship offering instead of blocking on the perfect chat solution. Good luck!
Couldn't you create the account for them ?
On one app that did require an account, a user can use the app up until the point they need to save something, which is when I take their email address and password and then they are in.
Email is only for password resets. But I don't think I will even require that by default in future. Perhaps a prompt that the user can add their email address just in case they forget their password, but not require it.
For non technical users, the friction involved in setting up new accounts is a bit too much.
Anecdotally: my tech-handicapped friends all used hangouts. I suggested discord, but everyone wanted to continue using something they were familiar with. Once they did get Discord and discovered how easy it was to start conversations.... nobody went back to hangouts.
Anyway, that’s great. Do this. Maybe more people can do this.
Seems like a great idea... until a few years down the line you run into an issue for which you need to send a message to your users. And you can't.
These are often legal issues. Needing to forward on take-down notices, changing privacy laws (remember all of the emails that were sent out when GDPR came into effect).
Legal issues aside, the killer challenge is account recovery. People forget their passwords. How are you going to give them back access to their account without a verified communication mechanism?
The mindset around account recovery would be: if you value your information in your account, add an email. Otherwise, you can start again if you lose it. Doesn't work in all situations.
This is kind of missing an elephant in the room.
Because even creating an account on discord after clicking a "join server" link only requires you to put in an username. No pointless e-mail requirement, not even a password, no nothing. Put in an username and you're good to go.
This might look particularly weird to some of the HN community who are fond of optimizing the conversion rate of their pointless landing page -> sign up flow and like to subscribe people to mailing lists that 97% of their users will find fucking annoying.
I've been doing a similar thing to discord on a site I run where users don't even have to choose a name. They get a randomly assigned name which they can change later if they want. A new user needs to perform 0 clicks to begin using the product.
This was especially helpful in the beginning, because the first few people who stumbled upon the site immediately became users and started interacting with each other. By adding stupid landing pages, sign up flows, analytics (which then requires me to get permission from my users), and whatnot the site probably wouldn't have gotten off the ground half as fast.