&gt; I don&#x27;t want to impose that privacy failure on my users, but I also don&#x27;t want to impose the annoyance that is &quot;Sign up with a username, email address, and password&quot;.<p>Why not just &#x27;log in with email address&#x27;?  The user provides his email address; you send him an email with a URL of the form <a href="http:&#x2F;&#x2F;www.invalid&#x2F;path&#x2F;to&#x2F;resource?access_token=aSBkb25lIGF1dGhlbnRpY2F0ZWQgdGhpcw" rel="nofollow">http:&#x2F;&#x2F;www.invalid&#x2F;path&#x2F;to&#x2F;resource?access_token=aSBkb25lIGF...</a> (where aSBkb25lIGF1dGhlbnRpY2F0ZWQgdGhpcw is a cryptographically-authenticated account identifier).  When he follows the URL, you can set a cookie if you want him to be automatically logged in next time he visits your site, or not if you don&#x27;t.<p>Extending this to be one-time only (to prevent replay by an email provider) is an exercise for the reader.