What are the pros and cons of using an email as a username? [closed]

Answer 1

Email (pro) - lessens account-creation spamming because you could confirm their account by sending an email to them.

Answer 2

I've done this for b2b apps and its a real pain when a user leaves a client company an someone else is using the old deactivated email address as a login and purposely not changing it to avoid getting email from us.

We end up with password-reset email that bounces and support calls to fix things.

Answer 3

Another problem that may arise when using the email as username is "user harvesting" attack. For example, if you have a "change email" page or when creating new user, if the new user insert an email which is already exist then the application will have to send back an error. Consequently, an attacker can discover all the users in the application by executing a simple script (in case the user doesn't exist it will be added )

Answer 4

Another note if you're going to allow accounts to be public is that not requiring a username means you have to allow for a "Display Name" (you certainly wouldn't show an email address), but if your users want to use their real names there's potential for duplicate names which could cause confusion (think two SO commenters with no pictures and the same name, the assumption is that it's the same person unless you clicked through to a full profile). In that case you'd either have to force a unique Display Name (which could keep someone from using a real name) or just accept that you may have two Bob Johnson's hanging around confusing people.

Answer 5

PRO: It seems that some services are considering making e-mail the standard for identifying a specific user across the net:

e.g. http://www.techcrunch.com/2009/08/14/google-points-at-webfinger-your-gmail-address-could-soon-be-your-id/

CON: This hasn't happened yet, and there are lots of other options such as OpenAuth and OpenID that are around now and have some support (you also have login using Facebook spreading).

Just tailor your choice for identity to whatever the target audience of your app will be.

Answer 6

CON: It's one less insulating layer between the user and spammers. If, somehow, somebody got a full list of usernames, they would be able to spam all your users. But if the site uses usernames, with emails as a secondary field, this isn't a concern.

Unless they get all user data, of course, but that's a much bigger problem anyways.