Yes and yes! Many throwaway accounts I have use some variation of the same password, because I don't care if someone hacks my HN or reddit or youtube account. I don't use my real name on any of them. If I lose control of it, I'll just make a new one. (Karma doesn't pay the bills, and I don't make money from my very excellent youtube comments; someone else does.)
This is why all these accounts get an email account that doesn't include my real name, too. There are so many sites that have these signup dialogs that require an email address -- why? Oh yeah, that's right, user data is the oil that will fuel the future economy.
I do the same thing. I have my crap/spam/don't care account (at yahoo.com). All the accounts that use that email address (which has zero ties to me - though you have to be careful over time not to leak information) also all use the same password. Couldn't care less if anyone ever ties two random and anonymous accounts on the Internet together. My important accounts have huge passwords from a password manager.
There isn't a day that goes by that I don't get an email intended for someone else, often including personal information, due to a mistyped email address. Whoever decided that email verification was a poor user experience needs to be hit in the head with a shovel after he digs the appropriate sized hole.
If you know Catherin (PA) let her know her round trip to vegas is confirmed
Carolyn's (NYC) open table reservation was canceled by the restaurant.
Different Carolyn (CA) needs to correct email address with the walnut creak school district.
Possible the same Catherine (PA), your financial advisor needs a distribution form filled out.
Clint (OH), your repair at Kay jewelers in Akron is done.
Ann (FL), Thank you for scheduling an online appointment with Conley Subaru
sigh, you get the idea
Edit:
Oh, and I'm going to start canceling Open Table reservations that show up in my inbox.
What's even more annoying is that some sites ask for verification, but then proceed to email you stuff even if you don't click verify. Someone in Australia created an Apple ID using my email. I ignored the verification, but then I got a bunch of purchase receipts from them later.
What I really wish for is a link in emails that say "I am not the intended recipient of this letter." Normal mail works like that. You can ask the United States Postal Service to only deliver mail that has your name on it, and if you send back mail with someone else's name they will add that person's name to a database that says the mail is undeliverable.
I don't want to mark these organizations as spam, but that's basically what they are to me. I've started using the password reset to log in and change the email preferences so I don't get these emails anymore.
I had the same problem with someone signing up for an Apple ID with my email address.
I even tried calling Apple to get them to cancel the account, but they wouldn't let me because I couldn't answer any of the security questions on the account!
The guy on the phone acknowledged that of course I can't answer them, because I didn't create them, bit their policy forbids them from doing anything without the security questions...
Man, now I'm wondering if this is some sort of violation of the CAN-SPAM act. My blood pressure goes up a little every time I get one of these emails and it doesn't have a way to unsubscribe if you aren't the legitimate recipient. Considering the companies that spam me the most with this irrelevant crap are Apple and Wal-Mart, I would feel 0% bad if they lost money over this practice.
Quick Edit: I just read the Wikipedia page, and individuals cannot bring suit against spammers (using CAN-SPAM in any case). Which is a shame really, because spam is really really annoying.
Instagram does this. They let anybody sign up for an account using any email address, and the account is immediately live. While they send a verification email, you don't have to click on it to still use the account. And most likely if you hadn't signed up for the service you'd think it's a phishing attempt and ignore it anyways.
I found this out the hard way when someone else had created an account under my email address and because some of my friends had uploaded their address book, my friends were following this stranger, perhaps thinking it was me. When I eventually did choose to sign up, I had to jump through a bunch of hoops just to be able to use my own email address.
I suppose there may be some sort of anti-hacking law that could be twisted to fit this case, and if the cops came to my door over it I'd definitely hire a lawyer before I said anything. I somehow doubt if I'd be charged with a felony for accessing an account that is registered under my name and email address and turning off email notifications, especially since I've tried everything else I could think of to stem the tide, including emailing support, etc.
Plus, this individual who keeps signing me up lives in Australia. I cannot imagine our system is so dysfunctional that both the United States and Australia would agree that a) this is a criminal offense, and that b) it would be worth going through the effort of extraditing me to face justice.
I mean, I haven't even received another password reset request from those websites I logged in to fix that issue, so I half imagine that person is using my email address as a plausible address for email they don't care about.
I understand what you mean, but I don't think I'm going to have to spend the rest of my life looking over my shoulder. The few personal emails I've gotten with financial details (gym membership bills, etc) I've responded letting them know about the mix-up and they've been more than happy to fix the issue. Feel free to say I told you so when I end up in a jail full of kangaroos though.
As someone with an unusual name (used for my public-facing email address) and who uses a fairly unusual email for personal stuff... that's pretty different from my experiences. I've never ended up with someone else's mail at all.
That's a solid argument for business cards with vCard QR codes as I see it. Or a pack of stickers with QR codes that you could slap on whatever documents you needed.
It's too bad QR code adoption is so horrible. I'm just as guilty of it as anyone else, I assume that any QR code is probably just some marketing thing.
But vCards seem like one of the very legit use-cases. Now that I am imagining using stickers and never filling out my contact info on a form again, I realize that's definitely a world I want to live in.
> As someone with an unusual name...and who uses a fairly unusual email for personal stuff... that's pretty different from my experiences. I've never ended up with someone else's mail at all.
I think it's more likely if you use an initial in your email address. I have a fairly unusual last name, but I used my first initial to create my gmail address, so I regularly get stuff meant for a couple of other people.
Business cards or sheets of stickers are not going to solve this problem. The former is not universal, and you're not going to get enough adoption for the latter (do you really want to carry them around in case you need to put your email on a form?).
The only solution that might actually work is to put some kind of financial penalty on certain classes of email sender to incentivize reasonable levels of validation.
I could overload my pockets carrying around all kinds of special purpose labels and stickers, and track my stock of them so I don't run out....or I could carry a pen.
> Do you people really not keep a book of stamps in your car?
> Whoever decided that email verification was a poor user experience needs to be hit in the head with a shovel after he digs the appropriate sized hole.
That's why you get send the verification email first, when creating the application user, and don't do anything until the email is verified.
The flow should be:
User: Please give me an account; my email address is [email protected]
That is what I was trying to say. Apparently there is some number of designers that believe that that whole email verification process is too much friction for registering a user, so they simply opt not to do it at all.
I have (first initial)(mid initial)(last name) at gmail. Same as my HN id. And a very common last name! 16 months into my first job out of University I got a call from a headhunter intended for the other Chris Miller sitting 2 cubicles away from me. At my second and fourth jobs there were also other Chris Millers. And from my list of examples, most all have the same last name.
4 days into university, the first time I logged in to the email account, I had several messages waiting for me, all intended for the same person, the best of which was:
"Hi X. The £80 million for the new biomedical building is approved, please make the transfer ASAP."
It turned out I had the same unusual name as the most senior financial officer.
My last name is pretty uncommon, but there are at least a thousand of us or so in the US.
I probably get a dozen emails a month to people who are not me (not counting all the ones that end up in the spam folder after I'm on a damn list).
Susan. Stephen. Another Sam. So many damn S. Lastnames around.
On occasion I've tracked the people down. I've forwarded their emails if they seem important. And whenever I ask that they be more careful and memorize their own email address, they get defensive and tell me someone else made a mistake.
Buddy, this email was was an automated response from a computer
after you signed up for something. No, it did not just randomly decide to send to my @gmail instead of your actual @yahoo address. YOU just don't know your own email.
Enough people clearly do -- they think that all email addresses end in @gmail.com, even if they check their email at yahoo.com. Because we have an email monoculture.
I have an uncommon name spelling and I still get misdirected emails.
Not to the extent of the above, but for instance, last year I received someone's job offer in Colorado. I did respond to the sender to let them know of the mistake of course.
My most entertaining email yet was a group thread that kept track of a young missionary's progress as he traveled through South America. He's home now, so I don't get weekly updates anymore :( I almost miss it.
I've always assumed it was for password recovery. People forget those all the time, email is a quick way to verify identity. Since everyone can have an email address for free. If you have a better way, do tell. Also, when your email is your username, that's one less thing to remember.
Then you're effectively banning someone's existing account, which they could have been using for years at that point. There's a lot of potential content there. Not a great feeling for anyone.
Seems like the simplest solution is to have some basic password requirements.
I think the OP and other posts here have demonstrated that password requirements won't solve anything given a sufficiently incompetent or not caring user. If the platform provider cares more about the security of the account than the account holder there isn't much you can do.
well I really need to remember part two, for too long I just used an old email I no longer had as my primary account but it does incorporate my last name. time to get smarter. thank you for wake up
This is why all these accounts get an email account that doesn't include my real name, too. There are so many sites that have these signup dialogs that require an email address -- why? Oh yeah, that's right, user data is the oil that will fuel the future economy.