Take the 2-minute tour ×
User Experience Stack Exchange is a question and answer site for user experience researchers and experts. It's 100% free, no registration required.

The concept behind "Remember my Username" and even allowing browsers to save your "username and password" for this site seems like it could be controversial.

Given that different audiences prefer different settings for logging in, should a site, when you log into it, itholds access to your credit card info and other potentially personal information, give you the option to remember username/Time you out after leaving the site?

This practice seems to be pretty common with browser features asking if you would like that info saved.

share|improve this question
add comment

1 Answer

up vote 4 down vote accepted

Definitely don't keep a long lasting cookie for sites like this. When financial/similar information is at stake, erring on the side of security is good UX as it gives the user peace of mind and they're likely familiar with and understand common security practice. Every bank website worth using automatically logs you out after a fairly brief timeout and there's no "remember me for 2 weeks" option.

A better route to go might be Amazon's pattern where you remember the username of who logged in, but require a password any time the user tries to do anything that would require or access private/financial information (a pattern I explain a bit more about in this post).

Chase.com does a similar thing, slightly more secure:

enter image description here

There's an option to remember one's user ID on this PC. This helps me log in a bit easier but the most secure part of my credentials, the password, still has to be entered each time. Note that unlike Amazon there's no reason you'd be on Chase.com except to view financial information or to make payments. Amazon has it's half-logged in state because some stuff like browsing (and tracking) can be personalized without significant privacy issues, unlike say paying your credit card.

Also as you note, most browsers have an option to remember user names and passwords. I've seen some sites evade those prompts, but I'm not sure if that's by design or just a result of awkward HTML structure making it so the browser doesn't recognize fields as part of a login (I guess it could be both).

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.