[1eyedjack]

I wouldn't have expected this to be an issue, but it has come up twice in a week.

Most web-based games and forums that require registration of an account also require the customer to enter an email address, and possibly a special private question, so that if the customer forgets the password or account ID these can be emailed on request, when the administrator is satisfied as to the bona fides of the request.

BBO does not operate this way (BBO forum might, I have not checked, but the game site itself does not). It checks that the ID is not already taken, but beyond that requires nothing more than a password. Accordingly, if player forgets his ID or password, there is no way that admin can distinguish the request for assistance from a malicious attempt to crack an unauthorised account.

There is of course an obvious work-around: Simply set up a new account. This is in my view less than ideal for several reasons:
1) The player may prefer the original ID.
2) The player may have to go to the trouble of notifying friends of the new ID.
3) Some other player might have liked to use the new ID.
4) The new ID would have to be registered with ACBL if taking part in master-pointed tourneys in order to merge the history.
5) If the old ID had accumulated some of the BBO master-points (those things that end up with a number against your ID when viewing the lobby) then that history gets lost.
6) If the old ID has a credit of BBO$ then this may get lost (I feel sure that there must be a solution to that already established)
7) If the old ID has purchased some unexpired time on robots or money tourneys or has winnings to collect then this history may get lost.
8) The server gets cluttered up with dormant accounts (probably not an issue).

Like I say at the outset, not a big issue, but it has come up twice now with colleagues. It surprises me that it ever does, but there you go.

[uday]

The original BBO asked for an email address --- then made it visible to others.

I'm mildly reluctant to ask "everyone" for an email address. Perhaps I should not be. There are some clear advantages to having it when it comes to password recovery.

U

[qwery_hi]

uday, on Jan 4 2009, 12:19 PM, said:

The original BBO asked for an email address --- then made it visible to others.

I'm mildly reluctant to ask "everyone" for an email address. Perhaps I should not be. There are some clear advantages to having it when it comes to password recovery.

U

I think if the user chooses not to enter an email address, his/her password will not be recoverable. This choice may be ok with some users.