What are the pros and cons of using an email addre

Question

I'm creating a web app that requires registration/authentication, and I'm considering using an email address as the sole user id. Here are what I see as the pros and cons (updated with responses):

PROS

1. One less field to fill out during registration (it would just be email address, password, and verify password). I'm a big fan of minimalistic registration.

2. An email address is easier to remember. (thanks Mitch, Jeremy)

3. You don't have to worry about your favorite username being taken already - you're the only one who uses your email address. (thanks TStamper)

CONS

1. User has more to type every time they log in.

2. What if a user wants multiple accounts? They'll need another email address. (Do I even want a user to be able to create multiple accounts?)

3. Easy for a potential attacker to guess (if they know the target's email address, they know the login id). (thanks Vasil)

4. Users may be tempted to use the same password they use for their email account, which is bad security. (thanks Thomas)

5. If you change email addresses frequently, it may be difficult to remember which address you used to sign up for a site after a long hiatus. (thanks Software Monkey)

6. A hacker could spam the registration form and use "email already taken" responses to generate a list of valid emails. (thanks David)

7. Not everyone has an email address. (thanks Nicholas)

If I went with email as id, I would provide a mechanism to allow it to be changed in the event a user changes address. In this case users would not be posting content to a public site, so a separate username won't be necessary to protect the email addresses (but it is something to consider for other sites).

Another option is to implement OpenID (which is a whole other debate).

This seems to work for Google, but their services are tightly integrated. What have I missed in my analysis? Do you have any recommendations? Does anyone have experiences to share?

FINAL EDIT

Thank you all for your responses. I have decided to use email as an id, but then allow the creation of a username for login purposes after registration. This allows a little flexibility while keeping registration as short as possible. It also prevents problems when a user changes email addresses (they can just log in with their username and update it). I will also be implementing methods to prevent brute-forcing of email addresses out of the registration and login systems (mainly a cool-down period after repeated attempts).

Answer 1

One setup you may want to consider: Have both a username and an email. The email is used to login and is always kept private, the username is used to identify the user in any public interaction, such as posting a comment. It winds up being slightly more secure as both halves of the user login credentials are kept private, whereas if you use a username for both login and public identification, half of the login is already known.

I definitely agree with you about having minimal registration for most cases, but depending on what you're doing you may want to balance that against added security for your users. Four fields isn't outrageous for registration, (username, email, password, confirm password), and if you're feeling particularly adventurous, you could cut it down to three by dropping the confirm password field, or two by emailing them a password that they can change later.

Answer 2

CONS

3. When the same password is used for the e-mail account, compromising the one automatically means compromising the other.

Answer 3

CON: Not everyone has an e-mail address. Consider if your database is ever accessed by an internal application. If you are running a store, people will call up and place an order by phone and refuse to provide an e-mail address. So while having an e-mail address as the default user ID is cool, be sure to allow alternates to get into the system. (Of course, this depends on the context.)

Learned this one the hard way.

Answer 4

I tend to not prefer pro/con lists, and instead try to think of benefits and challenges.

Challenge:

Some users will be tempted to use their email address from their ISP. Linking to an email alone, may be difficult for the users who forget to update their email in all the web sites they have signed up for before they change ISPs.

Instead:

You should consider allowing a user to provide multiple addresses, as well user-selected id and then let the user decide what they want they wish to do. Perhaps also consider allowing the user to provide an OpenID account.

Answer 5

CON: If a hacker can try registering random email addresses en masse, he or she will be able to figure out which of those addresses are valid based on which registrations fail. This is a tactic that can be used to put together lists of known valid email addresses, which are a hot commodity on the spam black market.

Although now that I think about it, that's a problem that affects any website which asks for an email address as part of the registration process, regardless of whether or not there's a separate username. But it's still something to think about.

Answer 6

As a user of websites, I can tell you that I hate memorizing unnecessary usernames. I don't use a unique handle or anything so I can never remember which variation of my name I used that wasn't already taken. I'd much rather type my email address.

Also, I like OpenID.