3

I'm having this discussion with a customer of mine, he wants me to pre-populate the user's email address on the login form, to make it easier to login, he does not want me to add a checkbox to have the option to "Save email address" or something like that.

What is the best usability/security issues here? Any recommendations?

Improve this question
1
  • 1
    Not unless I have given you my permission to do so. (And the default should be not to store it).
    – Marjan Venema
    Jun 24, 2013 at 18:18

3 Answers 3

Reset to default
2

I can't imagine there are any security issues with storing an email address locally in the browser (autocomplete, cookie or localstorage).

With that assumption, forms are often a huge pain point for users. Designers should do everything they can to alleviate this, and one of the most effective ways is by pre-populating known data. By default, I would provide an unchecked option to not save the data.

Autocompletion features are on the rise in browsers (in part) for this reason: UX designers haven't taken on the responsibility themselves.

Improve this answer
2
  • 1
    Not security perhaps, but certainly privacy issues, especially on machines used by multiple people.
    – Marjan Venema
    Jun 24, 2013 at 18:19
  • I decided to use the unchecked box to give them the option to save email address, for me as a user this makes the most sense.
    – MikeGA
    Jun 24, 2013 at 18:38
0

You can also be a little tricky displaying an email address like joh*****@mail.com

Improve this answer
4
  • What purpose does obfuscating the email ID serve when the user has asked to remember the ID?
    – rk.
    Jun 24, 2013 at 18:10
  • It prevents knowing the email by other users. Knowing the email allows to start the procedure of password recovery (either on site or mail server). An attacker pretending tech support also can contact with genuine user to pull some info. I.e. security reasons are rather convincing for protecting email.
    – Alexey Kolchenko
    Jun 24, 2013 at 18:23
  • The information is stored locally on the browser. And I do not get the tech support scenario you talk about. How does that come into play with you storing your passwords on your own machine?
    – rk.
    Jun 24, 2013 at 18:28
  • Tech support scenario is typical phishing. Another example is cracking Facebook account using email. Even you are not the hacker the step-by-step manual could be easily found on the internet.
    – Alexey Kolchenko
    Jun 24, 2013 at 18:43
0

From an UX stand point:

It is a good functionality to remember the username:

  • If the user uses multiple email IDs, this will help him access the account faster (given he remembers the password, ofcourse!)
  • One less place where the user can make a mistake (typos!)

However, this should be done at the user's discretion. Allow the user to select whether the email ID should be remembered or not. Also, do not trick the user into doing this by keeping it checked by default!

From a security point, I would go over to Security.SE.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.