Take the 2-minute tour ×
User Experience Stack Exchange is a question and answer site for user experience researchers and experts. It's 100% free, no registration required.

I find this way of doing it highly annoying when I come back to a site I haven't used in a while. First having to enter my email to get my username and then enter my username and email to reset my password.

Why do sites split it up like this? Is it believed to be better UX? Better security?

I mean, the weak point is my email in both cases, so if someone got a hold of that they would get both the username and the password anyways. So why not just combine it into one function where you only need to supply your email?

share|improve this question

4 Answers 4

I think it purely helps with the case if people can remember their password but have forgotten their username. Then a site can simply send out the username to the email address. This is safer, since it doesn't involve sending out the password in plain text. Or its less annoying because it involves needlessly resetting the users password - which means they have to go through the password reset process when they can remember their password.

If the user's forgotten their password then they should be able to click a link that says 'forgotten password' and an email with username and a new randomly generated password (or one-time token) should be sent to the user's email address.

Further to that as per this question the site could also accept both a username and email in the username input to avoid people forgetting their username. Then you only ever need the 'forgotten password' link.

share|improve this answer
    
Sorry to bump such an old post, but it should be impossible for you to tell someone what their password is. You should have no way of knowing or retrieving or sending their password to them because you should have it stored in a one-way encoded field ("salted and hashed") that cannot be reversed to find the original password. If you can send their existing password to them then your site is insecure and worse, acts as a security hole for other sites the user may use. One should only be able to reset their password, not retrieve it. –  Stephen P Jun 2 at 22:46
    
@StephenP I quite agree, what I meant with this is is a temporary 'reset' password is emailed out, not their current one. I'll edit it to make it clear. –  icc97 Jun 3 at 9:49

We contemplated using a one stop shop for resetting passwords and reminding users of their Client ID and Username (we're a mutli-tentant web-app, so we need both) but we decided against it for a couple of reasons:

  1. Security: Having one field allows someone to not know your username and it also allows them to change the password of the account in one step.

  2. Simplicity: due to the nature of our back-end services, we have multiple services that are used by our login system that made it easier to have multiple fields, like forgot username and forgot password.

  3. User Guidance: By having a login help form that says: "To reset your password, enter in either your Email Address OR Client ID and Username" as well as a separate (although very close proximity) form saying "If you forgot your client id/username enter in your email address" has helped our clients better serve themselves.

share|improve this answer
1  
Must say I disagree with point #1. Adding a second step doesn't increase security when the email is still the only key you need. For #2 I believe we shouldn't design our UX based on our backend services. Solutions should be easy to use for end-users, not developers ;) As for #3, it's a bit of a difference case you describe. "Email" OR "Client ID AND Username" ask for two separate kinds credential. In my case I was asked for "Email" to get username and then "Email AND Username" to reset password. Or did you mean that the password was only reset when you provided "Client ID and Username"? –  Svish May 30 '12 at 13:53

Well, this is some kind of old approach imo. A while ago username was usually used for two purposes: as identity (to log-on) and as something to display (when you post comments for instance). I believe it came from standalone apps and operation systems, where email is something secondary and username is something primary. Meanwhile it doesn't work in a web, where user email is usually a primary thing.

Modern sites have better UX by separating a way you log-on and a way you communicate with other users:

  • When communicating with other users, they only see your name, doesn't know how you actually log-in (email, smart card etc..).
  • When it come to your identity, email (or similar unique id) is used. So when you like to recover ability to log-in, you just enter your email address and password recovery process starts. Name is not involved.

So, finally answering your question, this wrong log-in approach causes also a wrong recovery process.

share|improve this answer
    
That makes a lot of sense. I fully agree :) –  Svish May 30 '12 at 13:44

I think the reason is that, when people forget their password, they have several pieces of information that they can use to retrieve it.

  1. Their username.
  2. Their email
  3. Their security question.
  4. etc.

However, when they forget their username, the sites can't use their username to find their username, because they don't know it. So the site has to use different pieces of information to find what their looking for.

Yes, in all of the cases the person still has their email, which can be used to identify their account, but it's still a good idea to get as much information about the account as possible, so no mistakes are made. By splitting up the process, the site is collecting as much information about the account as possible, so that they can be 100% sure.

In addition, most of the time people remember their password, but not their username, or vice versa. Separating the process makes it easier for them.

share|improve this answer
    
Hm, for me it's more like neither or both. Either I know both my username and my password because I've been using the site regularly, or I remember neither because it's been a while. And besides, the email should be a unique key anyways, so why ask for another detail? I just find that annoying. And also, the security question I gotta say is horrible... I usually put in an enormous hash of some sort as the answer and store it in KeePass :p (I do that for username and password, but I don't have all sites in there yet. Came over this issue with last.fm which I hadn't used in ages :) –  Svish May 26 '12 at 18:13

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.