I deal with a lot of high school students. To them, Facebook is identity. Email is throwaway.

OK, so how do you deal with a world where:

  - Many people never abandon their primary identity email.
  - But many other people often abandon their email identity.
  - You don't want to use a social network as the gatekeeper to *your* site.
  - You don't want to have human support for password resets.

Sekrit questions/answers along the lines of your first car's maiden name? Those can be forgotten just as easily as usernames for login.

wow, this is so interesting.... i cant even fathom that. getting old i guess

Don't you log into Facebook with an email address?

Sure, but the Facebook login is just "any e-mail address"; it doesn't really mean something for your account. You can add more e-mail addresses to your account, and all of them are allowed to be used to log in; the same, incidentally, is true of Google accounts.

You don't have to. You can use a username.

They still have [email protected] as a stable email address.

Not once a year, but here in new zealand for most people the email address is provided by the ISP. When they change their ISP, they typically get a new email address. Most people I know have changed their ISP a couple of times.

Surely most people in that kind of situation would move to gmail/hotmail/yahoo or similar, though? I'm sure my ISP offers me a free email, but I can't say I've ever used it (or even asked after it...)

Users using cloud e-mail addresses have addresses that are slightly more stable, but eventually they decode that @hotmail.com looks better than @aol.com, that @yahoo.com looks much better than @hotmail.com, and eventually that @gmail.com looks better than @yahoo.com. When they do this, they change their e-mail addresses, and often just derelict the old one so they don't have to think about it anymore.

Also, to the extent to which this becomes important, it only becomes important too late, as in after you've already used an address or two. I have had the same address now since 1997 when I registered saurik.com, but I did that because I had in the two years prior "learned the hard lesson" that my ISP-provided e-mail address was doomed to be something I'd end up having to move off of, potentially fairly often.