i really like it when it is the email address. then it is never taken, and i don't have to remember which one of my usual username variations i have to put in.
when it is the the mail address, this makes a strong case for also validating them, otherwise people can accidentally lock up other peoples address by misspelling their own mail address. i think a user will never switch mail accounts to get access to a site. and as the customer service person you will be reluctant to delete a stale account from a misspelling, only because somebody claims his address is blocked. so you better know in advance this cannot happen.
If you ever get into a situation where your site has over 50k users or so, you will see banned users switch email addresses to circumvent your security measures several times a day. I know I do, and my site only has 300k users.
The solution is to store banned IP's in your database, excluding massively-shared IP's like AOL, and check against this list during registration. I also keep a list of free proxies and prohibit people using those IP's from signing up.
Comments
i really like it when it is the email address. then it is never taken, and i don't have to remember which one of my usual username variations i have to put in.
when it is the the mail address, this makes a strong case for also validating them, otherwise people can accidentally lock up other peoples address by misspelling their own mail address. i think a user will never switch mail accounts to get access to a site. and as the customer service person you will be reluctant to delete a stale account from a misspelling, only because somebody claims his address is blocked. so you better know in advance this cannot happen.
If you ever get into a situation where your site has over 50k users or so, you will see banned users switch email addresses to circumvent your security measures several times a day. I know I do, and my site only has 300k users.
The solution is to store banned IP's in your database, excluding massively-shared IP's like AOL, and check against this list during registration. I also keep a list of free proxies and prohibit people using those IP's from signing up.
i was not talking about security, but about usability.