I'm on the fence in regards to whether I should implement user accounts or secret URLs. There are pros and cons to both, and I'm currently leaning in favor of the secret URLs because of the simplicity:
- Doesn't require email
- No registration and password recovery logic to implement
- Immediate results for the user without having to register
- Don't need to hash/salt user passwords and cache tokens
- Since the website is seasonally used, it's likely that users would forget the email/password they signed up with every year when they need it
Each address may only have one advertisement, so if a user irresponsibly loses his secret link against all warnings (didn't bookmark it, or didn't sync/backup his bookmarks), he'll be permanently locked out of editing his ad, and denied from creating a new ad for his address.
The secret URL would be in a user's bookmarks and/or history, so it would be their responsibility to encrypt their storage and lock their session as appropriate. If the URL is shared or compromised, there may be two guys fighting over this ad undoing the changes that the other person makes, and there's no objective way to prove who the real owner is.
I'd like to hear from people who've implemented the secret URL method, is it not as good as it seems? Can I expect users to save it in their bookmarks and never lose it? The two problems above obviously wouldn't be my fault, but would eventually fall under my responsibility to resolve in any case, so how would I go about preventing them from happening? (It can be easily worked around by allowing multiple ads per address, but that opens a new can of worms i.e. spamming multiple ads)