<?xml version="1.0" encoding="UTF-8"?><rss version="2.0"
	xmlns:content="http://purl.org/rss/1.0/modules/content/"
	xmlns:dc="http://purl.org/dc/elements/1.1/"
	xmlns:atom="http://www.w3.org/2005/Atom"
	xmlns:sy="http://purl.org/rss/1.0/modules/syndication/"
	>
<channel>
	<title>Comments on: Usernames Are So 1996</title>
	<atom:link href="http://www.wandco.com/31/feed" rel="self" type="application/rss+xml" />
	<link>http://www.wandco.com/31</link>
	<description>A small personal design firm</description>
	<pubDate>Tue, 06 Jan 2009 09:09:23 +0000</pubDate>
	<generator>http://wordpress.org/?v=2.7</generator>
	<sy:updatePeriod>hourly</sy:updatePeriod>
	<sy:updateFrequency>1</sy:updateFrequency>
		<item>
		<title>By: Jack DeNeut</title>
		<link>http://www.wandco.com/31/comment-page-1#comment-38</link>
		<dc:creator>Jack DeNeut</dc:creator>
		<pubDate>Wed, 31 Aug 2005 01:14:22 +0000</pubDate>
		<guid isPermaLink="false">http://www.wandco.com/?p=31#comment-38</guid>
		<description>I've programmed a number of e-commerce systems, and on my latest system I chose usernames over email addresses, for a number of reasons:

1. I have a lot of email addresses, and on email-address based systems, I often can't remember which address I used. That leads to a lot of work to log in, because when the login fails I don't know if I've used the wrong email address or the wrong password.  So, I end up trying dozens of combinations, and often just try all my email addresses through the 'email me my password link' (if one exists). 

2. Community - my newest venture is a C2C trading site, and it helps to have a username to show on the site rather than an email address. I realize you can ask the user for a 'nickname' or 'screen name', but that's another step for the user.

3. Many of these systems will not let the user change his/her email address after registering, as that would change the user's "username".  This makes for trouble when you close an email account or change jobs. 

4. In my last venture, many users simply re-registered when they lost/closed their existing email account. That makes for a mess in customer records. 

5. Why does every site I use need my email address?  Almost all sites ask for it, but in many cases you can enter joe@example.com and still get a valid account. 

6. What if someone wants two accounts with the same email address attached?  We have sellers on our platform that have business and personal accounts, and want the same email address for both. Sites like Amazon and PayPal require the email address used to be unique. 

I can see a lot of cases where an email address as a "username" makes sense.  What I'm thinking of doing is offering both - let the user choose a username or use their email address.  That seems like a solve that makes everybody happy.</description>
		<content:encoded><![CDATA[<p>I&#8217;ve programmed a number of e-commerce systems, and on my latest system I chose usernames over email addresses, for a number of reasons:</p>
<p>1. I have a lot of email addresses, and on email-address based systems, I often can&#8217;t remember which address I used. That leads to a lot of work to log in, because when the login fails I don&#8217;t know if I&#8217;ve used the wrong email address or the wrong password.  So, I end up trying dozens of combinations, and often just try all my email addresses through the &#8216;email me my password link&#8217; (if one exists). </p>
<p>2. Community - my newest venture is a C2C trading site, and it helps to have a username to show on the site rather than an email address. I realize you can ask the user for a &#8216;nickname&#8217; or &#8217;screen name&#8217;, but that&#8217;s another step for the user.</p>
<p>3. Many of these systems will not let the user change his/her email address after registering, as that would change the user&#8217;s &#8220;username&#8221;.  This makes for trouble when you close an email account or change jobs. </p>
<p>4. In my last venture, many users simply re-registered when they lost/closed their existing email account. That makes for a mess in customer records. </p>
<p>5. Why does every site I use need my email address?  Almost all sites ask for it, but in many cases you can enter <a href="mailto:joe@example.com">joe@example.com</a> and still get a valid account. </p>
<p>6. What if someone wants two accounts with the same email address attached?  We have sellers on our platform that have business and personal accounts, and want the same email address for both. Sites like Amazon and PayPal require the email address used to be unique. </p>
<p>I can see a lot of cases where an email address as a &#8220;username&#8221; makes sense.  What I&#8217;m thinking of doing is offering both - let the user choose a username or use their email address.  That seems like a solve that makes everybody happy.</p>
]]></content:encoded>
	</item>
	<item>
		<title>By: Ben Whitehouse</title>
		<link>http://www.wandco.com/31/comment-page-1#comment-22</link>
		<dc:creator>Ben Whitehouse</dc:creator>
		<pubDate>Thu, 30 Jun 2005 20:32:49 +0000</pubDate>
		<guid isPermaLink="false">http://www.wandco.com/?p=31#comment-22</guid>
		<description>James, unfortunately I'm not entirely convinced by your arguments. Sure if your password is found, it becomes a serious security issue but most users also use the same username, so by that same logic once they have found out your username and password it's all over. But having your password hacked rarely happens... In fact, I have never heard of anyone hacking a password if it's never been revealed by the user.

Also, I would take a look at incredibly secure websites that use e-mail addresses such as "Amazon":http://www.amazon.com/ or "Paypal.":http://www.paypal.com/ Each deal with huge numbers of users and transfers of money without reported problems daily.

I think you are right that usernames are more secure, but by how much? How much more secure are you with "sandrabullock" or "sandra@bullock.com" I would argue only marginally. As the saying goes "Locks are designed by gentlemen" - meaning that crooks will always find ways to get in. Take, for instance, the scrupulous fishing techniques used to obtain ebay passwords, there is a website that uses usernames without much security benefit to their customers.

As for community based sites, I too thought that usernames were the only option for creating an "online community" but was surprised to find two of the largest online communities "Friendster":http://www.friendster.com/ and "Flickr":http://www.flickr.com/ both use e-mail addresses for log-in. Once you're in the system you can have any individual user identity you like which is displayed to other users.

I still cannot think of any legitimate use of usernames other than e-mail hosting companies. They just don't make sense.</description>
		<content:encoded><![CDATA[<p>James, unfortunately I&#8217;m not entirely convinced by your arguments. Sure if your password is found, it becomes a serious security issue but most users also use the same username, so by that same logic once they have found out your username and password it&#8217;s all over. But having your password hacked rarely happens&#8230; In fact, I have never heard of anyone hacking a password if it&#8217;s never been revealed by the user.</p>
<p>Also, I would take a look at incredibly secure websites that use e-mail addresses such as &#8220;Amazon&#8221;:http://www.amazon.com/ or &#8220;Paypal.&#8221;:http://www.paypal.com/ Each deal with huge numbers of users and transfers of money without reported problems daily.</p>
<p>I think you are right that usernames are more secure, but by how much? How much more secure are you with &#8220;sandrabullock&#8221; or &#8220;sandra@bullock.com&#8221; I would argue only marginally. As the saying goes &#8220;Locks are designed by gentlemen&#8221; - meaning that crooks will always find ways to get in. Take, for instance, the scrupulous fishing techniques used to obtain ebay passwords, there is a website that uses usernames without much security benefit to their customers.</p>
<p>As for community based sites, I too thought that usernames were the only option for creating an &#8220;online community&#8221; but was surprised to find two of the largest online communities &#8220;Friendster&#8221;:http://www.friendster.com/ and &#8220;Flickr&#8221;:http://www.flickr.com/ both use e-mail addresses for log-in. Once you&#8217;re in the system you can have any individual user identity you like which is displayed to other users.</p>
<p>I still cannot think of any legitimate use of usernames other than e-mail hosting companies. They just don&#8217;t make sense.</p>
]]></content:encoded>
	</item>
	<item>
		<title>By: James Yencken</title>
		<link>http://www.wandco.com/31/comment-page-1#comment-20</link>
		<dc:creator>James Yencken</dc:creator>
		<pubDate>Thu, 30 Jun 2005 03:32:45 +0000</pubDate>
		<guid isPermaLink="false">http://www.wandco.com/?p=31#comment-20</guid>
		<description>I can see two more positives in having usernames:

1. An additional layer of security. Most people tend to use the same password as often as they can. Once their password is found out by somebody malicious, accessing other website accounts of the victim (without usernames) is as simple as entering the email address too. Simply forcing the user to pick a unique username (which for a site with as many users as eBay can be quite challenging) adds another barrier against nastiness.

2. For community purposes. Again I'm thinking of eBay here. Usernames in eBay are frequently used as a descriptive name of the sellers (eg: MemorycardsCheap or RareToysMichigan). Using email addresses instead would not only be less colourful, but might actually discourage buyers in situations where the email sounds strange (hotbabe413@hotmail.com) or foreign (jamesyencken@email.ru).

Don't get me wrong - I hate usernames too. But i think that some websites still have legitimate uses for them.</description>
		<content:encoded><![CDATA[<p>I can see two more positives in having usernames:</p>
<p>1. An additional layer of security. Most people tend to use the same password as often as they can. Once their password is found out by somebody malicious, accessing other website accounts of the victim (without usernames) is as simple as entering the email address too. Simply forcing the user to pick a unique username (which for a site with as many users as eBay can be quite challenging) adds another barrier against nastiness.</p>
<p>2. For community purposes. Again I&#8217;m thinking of eBay here. Usernames in eBay are frequently used as a descriptive name of the sellers (eg: MemorycardsCheap or RareToysMichigan). Using email addresses instead would not only be less colourful, but might actually discourage buyers in situations where the email sounds strange (hotbabe413@hotmail.com) or foreign (jamesyencken@email.ru).</p>
<p>Don&#8217;t get me wrong - I hate usernames too. But i think that some websites still have legitimate uses for them.</p>
]]></content:encoded>
	</item>
	<item>
		<title>By: Ben Whitehouse</title>
		<link>http://www.wandco.com/31/comment-page-1#comment-19</link>
		<dc:creator>Ben Whitehouse</dc:creator>
		<pubDate>Wed, 29 Jun 2005 21:56:08 +0000</pubDate>
		<guid isPermaLink="false">http://www.wandco.com/?p=31#comment-19</guid>
		<description>Well that's where your handy dandy password would come in. All these methods would always use a password for that final piece of verification... I guess I implied that, but didn't make the point explicit. With a password using e-mail addresses would be just as secure as a username.</description>
		<content:encoded><![CDATA[<p>Well that&#8217;s where your handy dandy password would come in. All these methods would always use a password for that final piece of verification&#8230; I guess I implied that, but didn&#8217;t make the point explicit. With a password using e-mail addresses would be just as secure as a username.</p>
]]></content:encoded>
	</item>
	<item>
		<title>By: Lisa Cumbey</title>
		<link>http://www.wandco.com/31/comment-page-1#comment-18</link>
		<dc:creator>Lisa Cumbey</dc:creator>
		<pubDate>Wed, 29 Jun 2005 18:58:38 +0000</pubDate>
		<guid isPermaLink="false">http://www.wandco.com/?p=31#comment-18</guid>
		<description>So, email address-only logins are convenient enough, but what's to keep someone from logging in with your email address? Why they'd do that? I don't know, but there's always someone with nothing better to do. I mean, there's bound to be a "sally@verizon.net" or "joejohnson23182@yahoo.com". I just made these up, but you know what I mean. Illegal? Yeah, like THAT works.</description>
		<content:encoded><![CDATA[<p>So, email address-only logins are convenient enough, but what&#8217;s to keep someone from logging in with your email address? Why they&#8217;d do that? I don&#8217;t know, but there&#8217;s always someone with nothing better to do. I mean, there&#8217;s bound to be a &#8220;sally@verizon.net&#8221; or &#8220;joejohnson23182@yahoo.com&#8221;. I just made these up, but you know what I mean. Illegal? Yeah, like THAT works.</p>
]]></content:encoded>
	</item>
</channel>
</rss>
