Accepting user registrations generally entails obtaining a means of contact which can be used to unlock an account whose password has been forgotten. By far the most common contact method used is email. GP may not have mentioned it in so many words, but the implication is trivial. Requiring unique registration on a site also demonstrably results in significantly fewer people actually making use of the site. It&#x27;s perceived as a burden, and people not unreasonably wonder why they have to providing sensitive information in order to find out whether there&#x27;s anything there worth providing sensitive information. As ever, whether or not you think this should be true doesn&#x27;t affect whether or not it is.<p>Too, leaving aside the question of whether it&#x27;s a security risk for the user, maintaining a password database is certainly a security risk for the developer. Having your password database stolen is a credibility disaster. Similar exposure of a collection of OAuth tokens, none of which provides any access whatsoever to privileged data and all of which can be trivially deauthorized by their owners or en masse by the application developer, is about as minor a concern as any security compromise possibly can be. From the developer&#x27;s perspective, that&#x27;s an extremely strong argument for three-legged OAuth.<p>Addressing the other alternatives in detail: Using session cookies alone is great, except that they will eventually expire or be deleted, at which point all progress is lost. That&#x27;s not a major problem, I suppose, but I can see people potentially being annoyed by it, especially shell cowboys who solve everything with one-liners. I&#x27;m not sure what &quot;The site could generate a registration for the user&quot; even means. And I think there&#x27;s a fair argument to be made that authentication via OAuth with a third party hits a sweet spot between user convenience on the one hand, and persistence and distinguishability of identity on the other.<p>Finally, I&#x27;m really not sure why &quot;they&#x27;re tracking you!&quot; is such a concern in this case. Yes, third-party tracking is an increasingly ubiquitous reality of life on the modern web, and yes, in many ways that is a very bad thing. On the other hand, there is such a thing as nuance, and I think it&#x27;s a pretty long stretch to argue that it is likely to result in a major privacy violation to let on to Github, or for that matter Facebook or Twitter if I had accounts with them, that I&#x27;m a programmer. I suppose it&#x27;s possible there are people who need to keep that a secret for some reason, although I can&#x27;t imagine what reason that might be. For them, it&#x27;s probably not worth it to use Advent of Code, even with a throwaway account. For me and apparently quite a lot of other people, it is. I&#x27;m having a very hard time seeing the <i>prima facie</i> unreasonability of that perspective that it seems like some folks do.