Using unique attributes for user login
Suppose a user can have multiple emails. A given email may be held by at most one user. Is email a good pick for login purposes (so that it's used instead of the username)? Should an authentication server accept all of their emails? Should the user pick the "main" email, the one they are allowed to use for logging in? If you think it's okay, should I extend it to any unique user attribute, like a phone number (which a user may also have multiple of)? I realize it's widespread and more user-friendly (since a person is more likely to remember their email or phone as opposed to their username, not used in everyday life). Still, I'm not totally sure it's worth the added complexity.
Suppose a user can have multiple emails. A given email may be held by at most one user.
Is email a good pick for login purposes (so that it's used instead of the username)? Should an authentication server accept all of their emails? Should the user pick the "main" email, the one they are allowed to use for logging in?
If you think it's okay, should I extend it to any unique user attribute, like a phone number (which a user may also have multiple of)?
I realize it's widespread and more user-friendly (since a person is more likely to remember their email or phone as opposed to their username, not used in everyday life). Still, I'm not totally sure it's worth the added complexity.