I’ve been recently working on this user authentication-login-thing which everyone of you should be familiar with. You sign up with username and password, wait for an e-mail and click on a link. Then you go to login and enter your username and password to be finally logged in. So what?
The system is actually not very secure. Besides using an unencrypted connection in many cases and insecure passwords, usernames are often visible on the whole website, while your e-mail address is kept safe. If anyone spiders through all sites he can get a whole bunch of usernames. Then he can run a list of typical passwords through each username. And if there are enough usernames, the chance to actually get into an account is 100%.
If you provide your e-mail address, why not use it for login? No one knows which e-mail addresses are associated with which account, so you cannot try typical passwords on them. The login gets more secure, your accounts are safer.
