Email addresses are not good 'permanent' identifiers for accounts
Email addresses, phone numbers, and even government IDs turn out to be fragile foundations for long‑lived online accounts, as they change, get recycled, or are lost — sometimes locking people out of critical services. Commenters argue that services should use opaque, stable internal identifiers (like UUIDs) and treat emails, usernames, and OAuth logins as changeable aliases, ideally allowing multiple per account and flexible recovery paths. Beyond implementation details, the exchange highlights a deeper problem: there is no universally “good” digital identity, only trade‑offs between usability, privacy, centralization (governments and big tech), and resilience to edge cases like migration, name changes, or account compromise.
Problems with Email as an Identifier
- Email addresses are not stable: people change jobs, providers shut down or get acquired, domains expire, and institutions (schools, ISPs) recycle addresses.
- Some orgs even prevent reusing the same email for multiple accounts (e.g., multiple physical addresses), creating friction.
- Tying account identity to an email that can’t be changed (or can only be changed via fragile processes) makes account loss or migration painful.
- Using email as internal primary key breaks when addresses must change, and complicates merges, deduplication, and access recovery.
Better Internal IDs & Database Design
- Consensus: use an auto-generated, meaningless internal ID (integer or UUID) as the stable primary key.
- Natural keys (email, SSN, names) are brittle because “real-world facts” change; even government IDs can change or differ across countries.
- Exposing sequential IDs can leak growth metrics and enable scraping; random IDs mitigate this.
- Good practice: separate internal account ID, login identifier(s), and public username/handle.
Alternative Identifiers & Their Limits
- Phone numbers are often worse than email: they change with moves, carriers recycle them, and international moves may force number changes.
- Owning your own email domain is seen as a partial solution, but domains can be lost due to expiry, hijack, or life events.
- Proposals span from passkeys, KERI/DIDs, blockchain-style identity, and public-key-based IDs to extreme ideas like DNA hashes or implants; commenters highlight practical and ethical problems with all.
- Government-backed digital IDs (national IDs, passports, mobile driver’s licenses, EU digital ID) draw mixed reactions: some see them as the only “good” identities, others as privacy and power-concentration risks.
Account Recovery & Multi-Channel Identity
- Many argue there is no single perfect identifier; robust systems blend multiple factors (email, phone, physical mail, government ID).
- Allowing multiple emails and login methods per account (password + OAuth + passkeys) is praised; it eases migration and recovery but expands the attack surface.
- A recurring theme: identity vs. proof-of-identity vs. pseudonymity. Some want strong, government-grade identity everywhere; others insist on preserving the ability to have multiple, unlinkable personas and to “start over.”