Allow users to create an account without email

Question

I have a website that requires users to enter email and password in order to create an account. I noticed that there are a lot of people that do not want to provide their email address during the registration because my website stores sensitive information about the users. Most people want to be as anonymous as possible if they use this website. I have thought about 2 different solutions:

1. Allow users to create a temporary account so that the user only needs to specify a username and can get full access to the website. The user will be asked after some time to complete the registration with email and password. The con is that the access to this temporary account will get lost if the user deletes the cookies of if the user uses the private mode of the browser. I expect that a lot of users will use private browsing on my website.

2. Users should sign up and sign in with their username and password so that they do not need to enter their email address on my website. The problem is here that the users may not get access to their accounts anymore if they forget the username or the password. If the email address is known, the access to the account can be restored quite easily. Another problem is that users need to remember 2 things in this solution: The username AND the password.

Is a higher privacy still worth the drawbacks of an registration without an email address? Which of these 2 solutions would be preferable? Are there any other possible solutions to build an anonymous registration process for a website?

I have also noticed that a lot of users use fake email addresses or temporary email addresses in order to sign up on my website.

Answer 1

You should first consider whether it's really necessary to register. E.g. many webshops allow ordering without registration (and in the case of digital content, users don't even need to enter an address, they just need to pay).

Losing access is a valid concern, but you can always make the email address an optional field during registration. Tell your users that it's their responsibility to remember the username and password and they can only get it back if they specify a (valid) email address. And most of today's browsers and/or password managers remember credentials anyway; I have hundreds of different passwords but they're all autofilled by Safari (except for a few vital services such as Gmail, Apple ID, and my laptop password).

Another option to consider is to let users register and sign in via third party services such as Facebook, Twitter, Google+ or Stack Exchange via OpenID. There are many libraries available for integration with OpenID.