Hacker News Reader

Comment by Afforess | Hacker News Reader

I like idea of Persona, but the idea of requiring emails prevents me from ever implementing it. There are plenty of places where I need an identity system, but don't want to force users to fork over their email address.

View on HN

From their docs: "The protocol does not require that [identity provider]-backed identities are SMTP-routable, but it does require that identities follow the user@domain format."

The protocol still requires an identity provider to attest to your identity, but the actual identitifier doesn't appear to have to be a real email address. It seems like you could use anything in email address format.

You almost always want their email address so that you can email them a password reset link in case they forget their password, which is even more important on smaller obscure sites where that's bound to happen.

If users don't want to provide an email (and then can't reset their password), that should be their prerogative.

As a user who doesn't want to provide my personal email to random services, I have a throwaway email on a different provider with a gibberish username. Given that signing up for 99% of services already requires an email account (or a Facebook/Twitter login, which themselves require a verified email address), Persona is no less onerous.

Realistically, in the modern commercial Web, a user who doesn't want to provide an email probably has negative lifetime value.

Yes but with Personna you don't need to send them a password reset link because they have no password in your system :)

Reply on news.ycombinator.com