Take the 2-minute tour ×
User Experience Stack Exchange is a question and answer site for user experience researchers and experts. It's 100% free, no registration required.

If you follow the pattern of allowing users access to your application without having confirmed an email (generally considered good UX), how do handle the case where they forgot their password? Very important in this particular case as the site includes personal health information.

Clearly, sending them an email with instructions to reset it is not appropriate, as their email is not yet verified. I came up with four solutions, but like none of them.

  1. Freeze a user out after, say, 1 week if they haven't confirmed their email. Then, during this one-week grace period, they cannot recover their email. (Somewhat problematic because it's a security issue to reveal whether an email address is registered during forgot password, so we'd be unable to actually communicate that password reset is unavailable to them based on not having confirmed).

  2. Add "security question" to signup. Bad for fairly obvious reasons.

  3. Just not let them use the site without confirming their email. Also bad.

  4. Just let them recover their password even without a confirmed email, but add some text in the site "if you haven't confirmed your email, someone could get access to your private health information." This would show in a banner at the top of the screen until they register, and have the option to have the email re-sent to any email address they choose. This might be the worst security case of all.

Any ideas?

share|improve this question
add comment

6 Answers

Don't ask for a password until the email address has been confirmed.

Problem gone!

Use the process of gradual engagement and start it off by asking only for the email address.

In the meantime, invite them to browse the site or guide through some introductory information, but don't let them do anything security related until the email has been confirmed.

Do give them a chance to view or change the email address or resend the confirmation email if necessary (eg it doesn't turn up for some reason).

Here's the signup form from Gravatar

enter image description here

Edit: Gravatar tell me that the biggest downside to this mechanism is account recovery for people who have subsequently lost access to an email address and haven't bothered to register another email address that would help them get identified.

share|improve this answer
    
Good point, except it will require a one more step (sign up, confirm and then complete with password) it may worth it! –  alexeypegov Dec 9 '12 at 13:39
    
More, but smaller steps is the concept behind gradual engagement. You ask only for what's necessary - as and when it's necessary. Maybe it's not possible 100% of the time and doesn't fit 100% of business goals but it's something to strive for where possible and may have benefits of increasing conversion and retaining customers longer if the process is easier. Having said that, there are lots of other factors that can play a part. For example, decreased sense of investment and loss for a customer if you annoy them and they want to go elsewhere. –  Roger Attrill Dec 9 '12 at 14:57
2  
A minor cheat: If a user clicks "forgot your password?" on an unconfirmed email, the account should switch to "confirmed" once the user resets their password (since they did so using a link within the email you sent them). –  Brian Dec 10 '12 at 21:56
add comment

If your site has other features, let a logged in user access those features without a confirmed email. But as soon as they want to link to confidential information require a confirmed email.

share|improve this answer
add comment

I think that you may try to resend the confirmation e-mail in a case of forgotten password. So, user will get a new confirmation at the old e-mail (specified at the registration step) and after confirmation he or she will be able to reset the password using standard procedure.

And you may also limit functionality somehow (let users read but not let them write, etc) until confirmation. It will motivate users to confirm their e-mails quickly and be sure e-mail was entered correctly, etc.

share|improve this answer
    
I appreciate the reply, but I don't think this is actually acceptable. If the user mistyped their email in registration and asks for an email to reset their password, if another person actually has the email they typed incorrectly, they could then create a new password and gain access to the user's private health information. –  cminu Dec 8 '12 at 20:54
1  
@cminu I can't figure out a solution for this case. The user may reregister then, I believe. Or it will become a risky game: you have no guarantee that's the same user who registered and there is no way to find it out (at least without security questions, etc). –  alexeypegov Dec 8 '12 at 21:13
add comment

When the user signs up for your Account (without E-mail Conformation) I would do the Following:

  • Ask him for an external E-mail or his Phone Number If he forgot his original E-mail (there is no confirmation for a Phone Number)
  • I would add an Security Question with an hint (The big Guys Google and Yahoo add Security Questions in their services)
  • And the last thing I would do is warn the user before you start using your service you need confirm you E-mail (In plain english you won't be allowed to use the service only when you confirm your E-mail (it will make your life easier)

I am Done :)

share|improve this answer
add comment

The simple answer is that you shouldn't allow a password reset (in any way) if the email address has not been confirmed and you care about security.

Secret questions are just another much less secure version of a password, and massively harm security.

The only real option it to resend an email confirmation. However, you should not let anyone log into an account unless the email is confirmed. If you do this, you won't have this problem in the first place.

share|improve this answer
    
Can you explain why letting them using the site without confirmation is so bad? –  Dvir Adler Dec 9 '12 at 6:13
    
If you need to have a password to use a site in the first place, then you need to have some secure way of resetting that password. Without confirmation, this isn't possible. –  JohnGB Dec 10 '12 at 2:04
add comment

As bad as it seems to be, 3 is the only sensible option, especially if personal information is involved. If the user doesn't understand the importance of this, he may be going to copy and paste his health record to his Facebook account, so you may want to keep him out, anyway...

I get the catch-all mailbox for my registered domain, i.e. the mailbox where each and any mail goes when the mailbox name or an alias for it doesn't exist. Regularly, I get exactly these mails there: You registered for our service, please confirm. It mostly seem to be the same 2 or 3 users who want to register for some gaming sites by using a fake mail address, choosing my domain for it.

Of course I never confirm. If they're going to do anything illegal, then the service would have my confirmed mail address linked to my domain. If they want to play there, then they can do it under their own address. And that's another reason to not allow the user to do anything: To protect the innocent mail address owners. If I wouldn't get the catchall, I wouldn't even know about this.

If I would be malicious, I could simply try to reset their password, entering their account. A decade ago or so, I had a mail where the service didn't require a confirmation, but instead sent the account name together with the initial, user-chosen password in plain text as a registration confirmation...

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.