@tortilla - after n retries, we will lock the account and email a randomly-generated password to them that is valid for 24 hours. On login, they will need to enter a new password.
@bayareaguy - email offers two advantages over username. 1) it's unique and 2) it can be useful for communications.
What do you mean by that? An email address does not uniquely identify one person.
it can be useful for communications.
Indeed, especially for spam marketers.
If you make me provide an email upfront I'm probably going to ignore your site or at best give you a temporary address. The only services that have my real address are ones that have proven their value to me. If you can't do that then chances are all the data I provide your service will eventually end up in the wrong hands anyways.
Maybe I'm confused, but here's where I think there could be a problem:
Let's say I register with tortilla@domain.com, pw-password
2nd visit, I think I'm logging in but instead I have a typo in my email. tortill@domain.com, pw-password (system thinks this is a new user and registers and gives the user access). The user thinks he's logged in with his original account, but instead has created 2 accounts.
after N tries, don't lock them out, use a captcha or something else. lock out policies enable anyone to launch a denial of service attack on your site for every one of your users they know email addresses for.
Comments
@tortilla - after n retries, we will lock the account and email a randomly-generated password to them that is valid for 24 hours. On login, they will need to enter a new password.
@bayareaguy - email offers two advantages over username. 1) it's unique and 2) it can be useful for communications.
it's unique
What do you mean by that? An email address does not uniquely identify one person.
it can be useful for communications.
Indeed, especially for spam marketers.
If you make me provide an email upfront I'm probably going to ignore your site or at best give you a temporary address. The only services that have my real address are ones that have proven their value to me. If you can't do that then chances are all the data I provide your service will eventually end up in the wrong hands anyways.
Maybe I'm confused, but here's where I think there could be a problem:
Let's say I register with tortilla@domain.com, pw-password
2nd visit, I think I'm logging in but instead I have a typo in my email. tortill@domain.com, pw-password (system thinks this is a new user and registers and gives the user access). The user thinks he's logged in with his original account, but instead has created 2 accounts.
after N tries, don't lock them out, use a captcha or something else. lock out policies enable anyone to launch a denial of service attack on your site for every one of your users they know email addresses for.