A 2012 study by Canada's federal privacy watchdog found that roughly one-quarter of popular shopping, travel, and media websites were sending personal details like names and email addresses to third parties without user consent. This alarming statistic highlights a fundamental problem with how many websites handle user identity and data. When you log in, what information should a website ask for? Many default to your email address, but this common practice might be putting your privacy and security at unnecessary risk.
Imagine a digital lock on your front door. If an intruder already knows half of the combination, getting into your house becomes much easier. Using your email address as your user ID on a website is a bit like that.
Your email is often public knowledge – it’s on your resume, social media, or shared with friends. If a hacker wants to get into your account, they already have a significant piece of the puzzle.
This article argues that websites should embrace a dedicated user ID instead of relying on your email address for login. It’s a simple change, but one that offers substantial benefits for your security and personal privacy.
The Security Argument: Why Obscurity Matters
When hackers target a website, they often try "brute-force" attacks. This means they guess passwords repeatedly until they get it right. If your login name is your email address, which is often easy to find, the attacker already has 50% of the login credentials. They only need to guess the password.
A unique, non-email user ID adds a layer of obscurity. It makes the attacker’s job harder because they have to guess both the username and the password. The Canadian Centre for Cyber Security, as of March 31, 2026, points out that using email addresses as credentials constitutes a collection of personal information, requiring specific security controls. Why collect and expose more personal information than necessary?
Some security experts argue that attackers can often guess a login name regardless of whether it's an email or a username. They say strong passwords and multi-factor authentication (MFA) are the real defenses. While MFA is crucial, adding obscurity to the login name still makes the initial guessing game more difficult. Every small barrier helps deter potential threats.
Privacy Concerns: Beyond Just Login
Your email address is more than just a login; it's a direct line to your digital life. If a website's database is breached and your email is exposed as your user ID, it opens the door to more than just account compromise. Attackers can use that email for targeted phishing attacks, spam campaigns, or to link your account to other publicly available information.
Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) mandates that organizations protect personal information with appropriate security safeguards and obtain consent for its use. When a website forces you to use your email as a login, it's collecting and using a piece of your personal information in a very public-facing way. The Office of the Privacy Commissioner of Canada (OPC) suggests that individuals should be able to choose their own identifier, not be forced to use a "real world" one like their name or email.
A dedicated user ID, like "customer A167" as the OPC suggests, can be completely separate from your real-world identity. This separation offers a clear privacy advantage, especially if you prefer to keep your online activities less connected to your primary communication channels.
The Convenience Argument (and Its Flaws)
Many websites use email addresses for login because it's considered convenient. Users already know their email, it's unique, and it avoids the "username already taken" frustration during sign-up. Some experts even claim that using emails can reduce sign-up abandonment by up to 20%.
However, this convenience comes with hidden costs. What if you change email providers? Many people use email addresses provided by their internet service provider (ISP).
If they switch ISPs, they lose that email address, and potentially access to all accounts tied to it. This can be a major headache for users trying to recover accounts or update their information.
Furthermore, while an email address is unique, its public nature makes it less secure as a primary identifier. The minor friction of creating a unique username is a small price to pay for enhanced security and privacy.
The Future of Authentication: Decoupling Identity
The industry is already moving towards more secure and flexible authentication methods. "Passwordless" systems using biometrics (like fingerprint or Face ID), magic links, or passkeys are gaining traction. Apple and Google are heavily promoting passkeys, with some predicting they'll dominate by 2030.
A key trend here is decoupling the account from the identity. This means your login method (whether it's an email, phone number, social login, or a specific username) doesn't have to be the core identifier for your account. Microsoft Entra ID (formerly Azure Active Directory) is even experimenting with allowing email as an alternate login ID alongside a User Principal Name (UPN), showing a recognition that flexibility is needed.
By using a dedicated user ID, websites can still offer email for password recovery or communication, but your login credential remains separate and harder to guess. This hybrid approach offers both convenience and a stronger security posture.
Shifting away from email addresses as primary user IDs isn't just a technical tweak; it's a fundamental step towards better online security and privacy. It forces attackers to work harder, protects your personal information, and aligns with the evolving landscape of digital authentication. For websites, it means building a more robust and user-centric security model. For users, it means a safer and more private online experience.