On 03/02/2016 01:06 PM, Stephen Michel wrote: > > On Tue, Mar 1, 2016 at 7:34 PM, Bryan Richter <[email protected]> wrote: >> On Wed, Mar 02, 2016 at 02:06:33AM +0200, fr33domlover wrote: >> >> Hello, I talked to Aaron on IRC and he told me `userIdent` is >> often an email address because that's what Persona logins use. So >> adding the new route means exposing people's email addresses, >> which we don't necessarily want. >> >> Indeed, we don't want that at all. I think the solution is to untie >> the "vanity name" /u/<MySpecialName> from both my login name *and* my >> email address. Especially relevant since I want to enable logging in >> with only an email address, even after dropping Persona, using the >> email token mechanism (i.e. "password retrieval without the password"). > > We have a couple of design questions to answer here. I'll provide my own > opinions. > > Q: If we untie the "vanity name" and login name, which do we show publicly? > A: Vanity Name, duh. That's the point > > Q: Do we allow users to change their vanity name, or is it fixed? > A: For MVP, fixed. In the future, I don't know. > > Q: If people can change their vanity name, what do we want to do with > the old name? Allow someone else to claim it, or keep it as a redirect > to their new name? > A: I see arguments both ways. If we allow others to claim it, links to > vanity names lose their permanence. If we keep it as a redirect, it's > possible to abuse the system and take up large numbers of available > vanity names. It's also easier to run out of (good) names, and there > might (?) be confusion if user A changes their vanity name and user B > takes user A's old name. These problems are solvable, but they add > additional complexity. > > Q: If people can't change their vanity name, what's the point in having > a separate vanity name? > A: Well, a login name might be something ugly, or it might be their > email address, which we don't want to *require* people to expose. > > Another implementation is Twitter or reddit's: your log in name and your > vanity name are the same thing, and are linked to an email address > (which you can use to recover your username if you lose it). Twitter > allows you to modify this name ("username"), reddit does not. When you > change your Twitter username, as expected (since they're the same thing) > it changes both your login name and your vanity name. It does not leave > behind any redirect trail. > > Generally, I don't like the idea of being able to change your login > name. I do like the idea of being able to change my vanity name (at some > point I want better than smichel17), but I don't like the idea of others > being able to change their vanity names, which is confusing for me (from > experience -- League of Legends lets you change your vanity name (there > called a "Summoner Name") and when people do that on the forums, it can > be confusing to figure out who is who anymore). I don't know how the way > people use Snowdrift.coop will differ from the way people use the > systems I've previously mentioned, so we may not need to worry about the > same things. > >
I think log-in should allow *either* a non-email name or an email drawn from the email column in the DB (which could allow multiple emails as log-in if we let people list multiple emails for a user, that's another issue, not MVP though). The one thing we cannot accept is a log-in that *is* an email but is unchangeable. In whatever capacity anything is an email, people need to be able to change their emails (although maybe not for absolute minimum alpha MVP sort of release).
signature.asc
Description: OpenPGP digital signature
_______________________________________________ Dev mailing list [email protected] https://lists.snowdrift.coop/mailman/listinfo/dev
