Take the 2-minute tour ×
User Experience Stack Exchange is a question and answer site for user experience researchers and experts. It's 100% free, no registration required.

Is it a good idea to only require an email address from users at signup (without a password or other details)? After they sign up, we will send a random password to their email address; this password can be customised after the user logs in.

Are there any possible downsides to doing this?

share|improve this question
4  
If you were to take this approach I would recommend that you get the user to change the password immediately to something more memorable. –  Captain May 23 '12 at 9:42
5  
your recent question asked about sending passwords in email, to which it was shown this is a bad idea. Are you still considering sending passwords via email? –  JonW May 23 '12 at 10:00
5  
@SarawutPositwinyu sending any password in plain-text, regardless of whether it will be changed or not later is a bad idea. –  JonW May 23 '12 at 10:21
2  
@SarawutPositwinyu it does not require email to be cracked by an attacker. Email is copied across a(several) network(s), with multiple machines handling it by its very nature. You might as well be mailing it to them in a clear envelope. –  Joshua Drake May 23 '12 at 14:09
2  
@BenBrocka so you are okay with a random person setting the password for your accounts? –  Joshua Drake May 23 '12 at 14:10

7 Answers 7

up vote 12 down vote accepted

Emailing the password exposes it, since it is sent as unencrypted text.

  • If you do email the password, make sure the user changes it during the first login.

  • Alternatively, you could send a link to a continue page where the user can choose a password. This link has to have a time limit, since the link is also sent as unencrypted text.

    You can use the same technique for resetting the password if the user forgets it.

Even if you do ask the user for a password during signup (this is the most secure out of the two options), sending an email for confirming the email address prior to enabling the account is a good idea (prevents others from signing up using your email address). This email should have a deadline (e.g. an hour or one day), so that the account will be cancelled if the email address is not confirmed. This will also enable signing up with the same user name but using the correct email address after the timeout.

Also, you may want to consider letting the user fill additional fields e.g. a display name or user name either before sending the email or after the email has been received.

share|improve this answer
9  
@ADO: The people from 4chan do this all the time for fun, and post fairly believable stories impersonating the user, such as saying that they are leaving their wives because they are gay, or - always impersonating the user - posting child porn pictures and then saying "whoops I posted the wrong picture how do I delete this??", etc. This can be very harmful to a person's reputation. Keeping blogs, dating websites, facebook and the like secure is of extreme importance. –  Andreas Bonini May 23 '12 at 13:36
1  
+200 for the security comments, plain text passwords are always the wrong choice. -1 for email verification since we are talking about user experience and email verification always adds to the length of the registration process. Additionally, for me, it feels like they want to be able to spam me later making me more likely to not sign up or use a fake email address; yes I can give a fake email address and still verify it. –  Joshua Drake May 23 '12 at 14:05
1  
@JoshuaDrake I keep getting emails from various sites that others signed up to using my address. I would gladly verify my email every time to prevent this. If the site asks for my email, it should verify it, if not then it shouldn't. –  Danny Varod May 23 '12 at 14:55
2  
@ADOConnection you don't need to hijack an email account to read emails. Unless the sender and every email server the mail goes through use a secure connection, a man in the middle attack can be used to listen to emails going through the web. See this link for more details: en.wikipedia.org/wiki/Email_privacy –  Danny Varod May 23 '12 at 14:59
1  
@ADOConnection - you're assuming that users will use different passwords for high and low security services, so that one password being stolen won't provide access to other services. That's a dangerous assumption. –  Jimmy Breck-McKye May 30 '12 at 1:01

Anything that reduces the friction in the sign up process is a good idea. If the user is presented with a form that requires more than a couple of seconds to fill in they're more likely to abandon the process. Only having one field to fill in is the ideal form in that respect.

Of course, the really important thing is it have something that the user wants to sign up for. Don't require sign up just to enter the site. That would guarantee that a lot of people won't bother.

As @Captain Spectacular points out make sure that the first thing they do when they do confirm their e-mail address/sign in is change the password. Otherwise they'd carry on using the generated password which might be a security issue (depending on how you generate and store the passwords).

If you can send a link to the "confirm e-mail and change password" page then that would be better as you are not then exposing either the users e-mail address or password (even if it is auto-generated) via a plain text e-mail.

share|improve this answer
    
What you also need to consider is the value of what you are providing to the user. If they want it bad enough, they will be willing to fill in more information and won't abandon as easily and will lock into the process. –  Captain May 23 '12 at 10:31
    
@Captain - that was partly the point of my 2nd paragraph. –  ChrisF May 23 '12 at 10:34
    
I agree. Also, in case the user needs to enter a username, it could be good to just show that input first. When the username is confirmed as free, you could display a message "Congratulations! That name is free!", and then reveal email and password fields. That means they have made progress on the process of signing up and are less likely to give up. –  Danik May 24 '12 at 17:03

The ultimate ux is to require nothing :)

Ask yourself if your product or service actually requires a password. Is an email address enough on it's own? Does the data you capture with the email address need to be password protected?

Could you send the user a confirmation email and only ever require a password from them when it's necessary? When it is, ask them for one at the point. A password is minimal effort if the perceived reward is high.

In any case, a generated password will always be a design fail. I've seen enough numbers in my time to know that you'll have users hitting that forgotten password link 80% of the time. Leave the user to enter their own password, don't even generate one.

share|improve this answer

I think this depends entirely on the context of the website, if for example you were building an e-commerce system and you wanted to streamline the sign up process so you can start building up analytics on that user as quickly as possible from a variety of cross platform devices that they access then an email address would suffice with a auto generated password.

Remember at this stage the user has no personal details stored within their account, they have only entered in their email address, and perhaps a name? The auto generated password / email would then force the user upon next sign in to change their password, you can hardcode the password into the link itself.

No information at this point could be considered to be 'dangerous' if it got into the wrong hands, and at this point the user is changing the password to one they feel safe and secure with.

However if at the sign in screen you are taking address, phone number, card details then auto-generating a password would un-secure and pointless, the user has already entered in a myriad of data, what would one / two extra fields be?

Would auto generated passwords work for banking, car loans or other financial services? No, for websites / accounts that have no personal information that could be used, yes.

share|improve this answer

100% good idea. You may leave only one email field or add some not required fields (when user in a good mood, he likely to fill some extra data)

share|improve this answer
    
Any constructive criticism? –  ADOConnection May 23 '12 at 21:01
    
I'm sorry I forgot to leave a comment. I thought as an answer that this was very poor. It's merely a short draft of your own opinion, with no reasoning what so ever. Own opinions without any factual evidence/reasoning to strengthen your case should exclusively be posted as comments, not answers. "100% good idea" is a very poor answer. That was why I voted this down. –  AndroidHustle May 25 '12 at 7:44
    
Ok, i'll note that for future answers, thanks for feedback. –  ADOConnection May 28 '12 at 15:55

I would say that in general the minimum should be email address and some kind of username. You generally wouldn't want to expose user's email address in forum posts, comments, etc.

share|improve this answer

The general idea is good, as user will not need to remember the login. He or she ends up with the login already well known to him/her.

Two watchouts regarding sending password to the registered email: * it should be temporary (like: 10 minutes, for completing the registration) * or even better, you should just provide a link in the email to go to a page where user can set the password. You will need to provide activation link anyway, so perhaps this is the best situation.

Of course everything depends on the system, in some situations it may be necessary to provide additional data.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.