12 · Reader accounts

An account gives a reader a durable name: comments signed the same way every time, without retyping a signature. For a site with conversation under its texts, that is the difference between a discussion and a guest book.

Sign-in runs through external providers or an email address, depending on what the instance enables. Reserved names — the author's pen name, for instance — can be listed in the configuration so that nobody creates an account impersonating the person running the site.

The rule that admits no exception: the database holds only a cryptographic digest of the session token, never the token itself. A leaked copy of the database allows nobody to impersonate any signed-in reader. This is one of those decisions that costs nothing while building and cannot be repaired afterwards.

Accounts are optional. A site that does not need them leaves them off and pays for them neither in complexity nor in an obligation to hold anyone's data.