What are the pros and cons of using an email address as a user id?

Question

I\'m creating a web app that requires registration/authentication, and I\'m considering using an email address as the sole user id. Here are what I see as the pros and cons (upd

Answer 1

CONS

3. When the same password is used for the e-mail account, compromising the one automatically means compromising the other.

Answer 2

CON: If a hacker can try registering random email addresses en masse, he or she will be able to figure out which of those addresses are valid based on which registrations fail. This is a tactic that can be used to put together lists of known valid email addresses, which are a hot commodity on the spam black market.

Although now that I think about it, that's a problem that affects any website which asks for an email address as part of the registration process, regardless of whether or not there's a separate username. But it's still something to think about.

Answer 3

To solve your con item of the email being too long to type in every time. I have implemented the StringScan Ruby library.

require 'strscan'    
def signup!(user, &block)    
self.email = user[:email] unless user[:email].blank?    
str = StringScanner.new(self.email)    
str.scan_until(/@/)    
str.pre_match    
self.login = str.pre_match

etc..

Then just change login method to allow either email or login to match password.

This works just like google or mobileme. A user can choose to just type in their email username (ie. username instead of username@gmail.com.)

Answer 4

One con might be that if it's an email address the login can be guessed by people and brute force attacks attempted. Which is not really a big issue, since on most sites today the logins are publicly displayed.

The biggest pro is that logins are easier to remember this way.

Answer 5

CON: If I change my email address, suddenly all my account names are invalid. My name doesn't change, but my email often does. I have occasionally revisited a site after a number of years, and been stuck... what was my email address two years ago???

Answer 6

A good setup is to require username and email. Allowing the user to login with either email address or username is very user friendly. An added benefit is the user can change their email address. It would also allow multiple accounts for one email.