Take the 2-minute tour ×
User Experience Stack Exchange is a question and answer site for user experience researchers and experts. It's 100% free, no registration required.

If you have a website where users 90% of time only read and view content, but rarely post, like a blog, does it make sense to force a login?

If I force the user to login to view some information, like how Quora.com lets you only view the 1st answer unless you log in, will this turn people away? Especially if other sites offering content close to yours don't force logins?

The advantages of a forced login are 2:

  • you know exactly who your user is and you can design your website according to user's behavior and
  • you can keep scrapers away much easier, especially if you hide the content scrapers want.

Generally, are people sick of logins?

share|improve this question
7  
You're not describing forced logins, but content locking by paid subscription. Getting their content indexed by google is a marketing tactic to gain more subscribers, but they don't want to show their content for free. –  Mathew Foscarini Mar 30 at 22:50
5  
I only visit that question/answer site when I forget to check the google link before clicking on it. However, I'm probably not representative to the average visitor (nor other programmers in general). –  Francisco Presencia Mar 31 at 3:46
7  
I'm personally only sick of logins if login page do not allow to store your password in browser and if the prompt to login pops up, especially with X button implemented in JavaScript, so that I cannot 'click' if from keyboard. Also if I get plain text password in welcome e-mail after first login. –  nuoritoveri Mar 31 at 7:38
10  
@FranciscoPresencia You're certainly not alone. I've even gone to the extent of writing a little GreaseMonkey script to remove that Q/A site from google results so I don't end up there accidentally. –  Basic Mar 31 at 9:07
17  
There's a site called BugMeNot that exists purely to provide fake logins people can use to access sites that "bug" users to log in. If it wasn't true that a significant % of users are sick of logins, that site wouldn't be commercially viable. –  user568458 Mar 31 at 13:24

12 Answers 12

up vote 62 down vote accepted

Answering you question, which doesn't involve specific motivation behind it. Yes, people don't like to register on sites, people don't like giving information all the time, people don't like remembering passwords and user names.

This behaviour is common to everyone, but some groups are more annoyed than others and some are more radical than others; for instance, a person that doesn't have much interaction on Internet except to look for some minor things like reading news, visiting one or two social sites and not much more, won't mind registering in one more site if he has a reason to. On the other side of the spectrum, a persona that is browsing a lot, and is already registered in many sites through the years, is more likely to leave a site and not use it again if he has to register and there is no good reason to it.

The most important thing here, is the reason. usually people won't mind registering and then login if you give a good reason for it.

Leaving comments on a blog, for instance, is something that doesn't deserve an account, creating an account on Amazon to buy things, is worth the effort.

Remember, the information or control that you want to have over the user is something that you want, not the user, from the user perspective, it's your job to keep the site clean and functional. Whatever you do behind your site doors, is your problem.

share|improve this answer
8  
it's worth noting that there are solutions to people not liking to remember username/password combinations: OpenID, Mozilla Persona, etc... –  strugee Mar 31 at 4:23
13  
Yes there are, but they still don't work across all Internet, so you still need a persona, and an OpenID, a facebook connect, an oauth, and ... –  PatomaS Mar 31 at 5:51
1  
+1. I'd add that if you insist on having the registration, as long as you provide an expectation of the content or access they gain, users have a basis for an informed decision. –  Pdxd Mar 31 at 13:10
11  
@Pdxd If the only benefit of registering is being able to see all the content, that isn't a benefit. The website is basically saying, "Register to stop me treating you badly." Well, why don't you just not treat me badly in the first place? –  David Richerby Mar 31 at 16:07
3  
Making an account to post something might make sense, as it's harder for others to post in your name. However, making an account just to VIEW information doesn't. –  vsz Apr 2 at 6:16

Yes and no. Logins (and sign ups) sometimes make people feel like they are part of something. A lot of the time, people sign up and log in so that they don't forget about a certain site, and to feel like they a part of the community. As PatomaS said - there often needs to be a reason to sign up. Special content, features, abilities. It's give and take. As users become more wary in terms of online security and their identity, there needs to be solid reasoning for them to part with their information - and what information, at that.

share|improve this answer
3  
I think you are WAY overgeneralizing. When I have to make a login, I often leave. If the site looks a little interesting, I check if there's a premade account on bugmenot.com . If that fails, I usually leave the site. For me, having to make a login is an annoying experience and I had never even considered that someone might enjoy it until I had read your post. I'm going to assume you're not trolling, but please, can you change your answer so it doesn't sound like it's true of most people? For me, it's as if I went to a library, and found I had to create a new login for every single book. –  Patrick M Apr 1 at 22:57
1  
It's different for everyone, though. If I found a site interesting, I would just sign up rather than go to the effort of bugmenot.com. I did say 'a lot of the time', not all of the time. And as with any answer - it isn't going to hold true to all people. Certainly not trolling, that's for sure. Everyones experience is different. –  Alphabeticaa Apr 1 at 23:51
1  
Ah. Maybe I misread your answer. I thought you were saying that making someone sign up for an account just to read your blog would be a positive thing for viewers, because it "makes people feel like they are part of something." –  Patrick M Apr 2 at 3:33

I disagree with @Alphabeticaa's answer. From personal experience, I hate it when I need to register simply because I wish to view an article or post a simple question. I have a "dump" e-mail address with a free provider especially for these "one-time" registrations but I try to avoid them.

As a concrete example, I often browse the Stack Exchange websites and regularly see an interesting post that I would like to upvote or quickly comment on. However, the fact that I need to sign up for every site separately, enter my e-mail address and password and going through a separate form before I can click the "+1" button, despite my having a Stack Exchange account, is so much of an extra step that I usually refrain from contributing even though I think it may be useful.

share|improve this answer
24  
Hm. On the other hand I'm registered with StackExchange via OpenID (Google), and I'm quite happy to comment on a new SE member site because it's just a couple of clicks: "Sign up", "Using Google", "Accept", "Confirm". No typing at all. –  AlexC Mar 31 at 11:26
6  
@AlexC I've just logged in to UX with this exact process, just to upvote you. –  Cyrille Mar 31 at 14:53
2  
@AlexC If you've already signed into Google and have a cookie saved, sure that works. Otherwise, if you're not you do need to sign in which naturally involves typing. –  Cypher Mar 31 at 23:05
    
@AlexC: I've had this process in the past, but when I just signed in to UX, I had to re-enter my password, because apparently the login form has been redesigned and Firefox wouldn't recognize the password field it had once stored the pw for anymore. I only invested the effort because I have been reading UX for quite a while and expect the ability to post to this site to be of future use for me. –  O. R. Mapper Apr 2 at 20:43

Hiding information behind logins is really bad from the usability standpoint. Imagine you are a user who googles for a certain piece of information.

Workflow on website without registration-wall:

  1. enter search-term into search-engine
  2. click on first result
  3. read question to confirm it's really relevant
  4. read answer

Workflow with registration-wall

  1. enter search-term into search-engine
  2. click on first result
  3. read question to confirm it's really relevant
  4. click on "register"
  5. enter username
  6. enter email address
  7. open password manager, generate new password, create new entry in password manager, put it in an appropriate folder enter that default password you use everywhere
  8. enter password again
  9. enter another username because it's already taken
  10. solve a captcha (several times because it's unreadable)
  11. click confirm
  12. open email client
  13. wait for confirmation email to arrive
  14. click on confirmation email
  15. find and click on link in confirmation email
  16. navigate to the website you were on
  17. read answer

How likely is it that a user will give up, navigate back to the search-engine and just pick another result which doesn't force them to jump through all these hoops?

To be fair, some of these steps could be made more convenient for the user, like not requiring a confirmation through email, using email as username or only using a very weak captcha. But when users see a "register" button, they usually assume the worst-case which is the above procedure and make their decision whether or not they want to go through with it.

Maybe you have a good reason to force people to register. Maybe your entire business model doesn't work without forcing users to make accounts. But keep in mind that by forcing user to register to even see what value your website provides, you are driving a large fraction of them away. Now regarding the two advantages you mentioned:

a) you know exactly who your user is and you can design your website according to user's behavior

That's true, and it might even be in the best interest of the user. But keep in mind that you can perform anonymous user-tracking without requiring any user action by using cookies or localstorage (but please respect do-not-track headers of browsers). Sure, cookies aren't really persistent, but any internet user should be aware that when they want to use features on a website which require persistence between sessions, they need to register. When they do not want these features, or do not want them persisted, they will definitely appreciate the option to not register.

b) you can keep scrappers away much easier, especially if you hide the content scrappers want.

When a scraper really wants to copy your content, what stops them from just registering an account? You can't hide your content from scrapers without also hiding it from legitimate users. There are no technical ways to prevent illegal copying of web content. Only legal ways.

share|improve this answer
3  
"When a scraper really wants to copy your content, what stops them from just registering an account?" - the same thing that stops a legitimate user from registering an account when they really want to see your content. Effort. Of course it's a different height of hurdle for a scraper relative to the baseline effort, than it is for a legitimate user. Someone scraping your site in particular will likely put in the effort. But it's enough to keep out (for example) Google's spiders, which is 90%+ of all web scraping :-) Ofc I know, Google respects robots.txt so login is irrelevant. –  Steve Jessop Mar 31 at 9:23
1  
@SteveJessop What webmaster can afford to drive away Google? Some popular forum softwares even have default accounts prepared for Google and other search engines so they can spider them like a logged in user. This is especially important when you want people to register for reading the content Google promised them. –  Philipp Mar 31 at 9:40
5  
Often you don't get automatically logged in after registering. In that case you are missing 17. Search for login button 18. Write username 19. Write password 20. Click login 21. Tell the browser whether you want to save the password y 22. Search in the history the page with the answer 23. Reload 24. Read the answer –  ntrrgc Mar 31 at 9:48
    
@Philipp: well, different people handle login walls in different ways, but one of the common ways is to show both Google and strangers part (but not all) of the content. That's what I had in mind when using Google as an example of a scraper that is being kept out. The use of that example was indeed partly intended to provoke the question, "oh, are scrapers inherently bad, and if not which ones do I want in?" :-) –  Steve Jessop Mar 31 at 10:30
    
@SteveJessop The question which scrapers to block and which to welcome is more of a topic for webmasters.stackexchange.com –  Philipp Mar 31 at 10:40

Depends of how user-friendly the site is

Not only forced logins irritate, but also passwords complexity policies and, of course, unreadable Captchas.

Password policies sometimes make more harm than use. If an user cares about his security, he often has his own password-making algorithms for different sites and when the password policy prevents him to set the password he wants to set, it confuses and irritates more than helps. Those who are careless about security, will not be treated with restrictions dictated by web site designers. And no policy can prevent to use the same password across many sites

About the captchas.... sometimes when I see this "prove that you are not a robot" accompanied with the unreadable picture I think than I might be a robot....

share|improve this answer
2  
+1 for mentioning captchas. On some sites, they kill the experience. If I am unable to recognize the captcha in first 2 or 3 tries, I end up leaving the site. –  Pathachiever11 Apr 1 at 17:47

If the users expect to spend a lot of time on the site, they would not mind creating an account. Otherwise you will lose the prospect, because the effort (typing e-mail, remembering the password) is not worth the benefit.

A good alternative is to use OpenID (like SE does - "Sign up", "Using Google", "Accept", "Confirm"). Just remember not to request any personal information from Google (b/d, gender &c) - people don't like snoops.

share|improve this answer
3  
I will not expect to spend a lot of time on a site, if the site makes me create a login to see it, as I will never know there is anything of value on the side. –  Ian Apr 1 at 7:55
1  
If I do not expect a lot of time on a site, but just post a single comment, the last thing I want to do is leave a "trace" that somehow links my visit on that site with that of other sites I use more frequently, in the form of an OpenID login used across several sites. In a way, if I site wants me to use an existing OpenID (or, heaven forbid, personal social network) account, I am even less likely to ever try and log in than I would be if I had to create a new local account on that site. –  O. R. Mapper Apr 2 at 20:50

4chan has a very unique user system that may be worth examining:

Anyone can post to 4chan, with absolutely no registration or login required; instead, users must solve a separate captcha for every post. Proof-of-identity for post deletion is handled by having users supply a password (by default, the client generates it for you, so you don't have to enter it), whose hash is stored alongside the post itself. Tripcodes are used to prevent impersonation, as described in their FAQ. When used alongside robust IP bans, their system works marevelously at deflecting most spam (which in this case might not include derp, which is actually the purpose of some boards like s4s). The captcha is only minimally irritating, since users have to wait between postings anyway.

Even their paid features do not require any registration. Users can purchase 4chan passes, which allow users to bypass the captcha when posting. Passes are per IP address, though, not per user, so any user on the same IP can use the pass. Proof-of-identity for changing the IP address associated with a pass works exactly like post deletion.

And throughout this all, there is no registration, login, or user account anywhere.

Users with moderation powers (in the case of 4chan, Admins, Moderators, and Janitors) may in fact have accounts, although exactly how it works is not completely clear from their public documentation.

share|improve this answer
1  
I'd also mention that for those who do want to get around the captcha, there are passes that can be bought that tie to the user's IP and allow them to bypass captch. There is still no registration process, the pass is ONLY associated with an IP and could let anyone with the IP bypass captcha and can be changed whenever (there may be a small cooldown) –  zero298 Apr 1 at 17:36
1  
@zero298 thanks, I've edited my post to include that, as well as the way moderation works. –  AJMansfield Apr 2 at 14:51
    
Warning: Password-only logins only work for a small group, because password collisions would allow some else to overtake an user account. The more users are involved, the stricter password rules have to be to avoid collisions. –  Chris Apr 2 at 15:48
    
@Chris but it is not a login! Guessing that someone uses p@$$w0rd as their password does not mean they know whose password it is, the same way guessing that a post was posted with a particular deletion password tell you what posts it allows you to delete. –  AJMansfield Apr 2 at 15:56
    
@Chris although I can see what you mean; mods probably do have some sort of moderator ID associated with the password because of that. –  AJMansfield Apr 2 at 16:05

Logins for trivial purposes aren't just annoying for users, they can be very dangerous. Here's why.

No one practices good password security.

You do. I do. Bruce Schneier does. But the vast majority of internet users do not. They use the same 5 or 6 passwords over and over again because everything else is just too damn complicated for them. Remember that your average internet user barely understands the concept of copying and pasting passwords, let alone generating them randomly from a browser add-on or keychain service that's stored in the cloud or what have you. By the time you get to the end of your instructions for using it you've lost 90% of your audience.

Browsers can remember passwords but this power is a flawed one - they don't always prompt to do so, and they don't always recognize the login page. At best it's a stopgap, not a real solution.

Any site with a password is a good hacking target.

Hackers love to get their hands on password tables, even from unimportant sites. It gives them a list of valid email addresses and passwords that the users are known to have used at least once, which can be used to try attacks against more valuable sites like banks or Paypal. With the power of today's hardware and the sophistication of modern day cracking tools, it doesn't matter much if the password isn't stored in the clear - hashing and salting don't help as much as they used to. Easily 50% of passwords, even things like "qeadzcwrsfxv1331", can get cracked in under a day. Anything people are likely able to remember can probably also be cracked. And once that happens, any number of user accounts on more valuable sites like banks or Paypal can be compromised.

You can't blame users for this.

Well, you can, but it won't help. No one's going to side with the owners of a website that was hacked if they try to blame users; at best you will lose your business and at worst you can end up being sued for insufficient security measures.

If it's not worth it for you to offer two-factor authentication for every user, it's probably not worth it for them to use passwords at all. What, if anything, you do for user verification instead depends on the precise nature of user interaction with your site; there are several models including free-for-all, 4chan-style tripcodes, Facebook/Twitter/Google accounts, etc. But if the most valuable thing you store locally is the user password, you don't need logins.

share|improve this answer

In a world with open ID, users are sick of sites that don't give them the option of using a login they already have but instead insist on them making a new username and password, and putting arbitrary password restrictions on them (e.g. exactly 8 characters, with 1 uppercase letters, 2 lower, 4 digits, and a squiggly).

share|improve this answer

Yes. Yes we are.

This is a perfect example. I was on Stack Overflow, logged in, and saw this question on the side bar. I wanted to comment and guess what - I have to log in again. Why? What is the point? Now I need to create a Stack Exchange account also?

What PatomaS said is dead on: "The most important thing here, is the reason. usually people won't mind registering and then login if you give a good reason for it."

Sadly, there are so many sites that do not have a good reason for it, or overly complicated, etc etc.

Things like "Sign in with Google" and "Sign in with Facebook" are making this a lot easier... but as a user I would prefer not to have these linked to my Facebook and Google accounts. Getting better, but still not perfect.

Also, it is ironic that the "Sign up using Stack Exchange" feature does not work properly on a User Experience page in IE8. (Can't upgrade - corporate computer. No lectures please.)

share|improve this answer

Generally speaking, people are coming to your site/app to perform a certain activity. Whether it's buying a present for their friend's birthday, or obtaining a piece of information related to their work. The fewer barriers you put between the User and them achieving that goal, the more successful the site/app you are creating will be in serving the User.

Requiring login because you want to build a mailing list (for example) is putting your needs ahead of the User, and Users will react negatively to that. Instead, provide value. Once you establish trust, you can more effectively request something of the User. You may get fewer registrations, but the ones you do get will be much more valuable.

share|improve this answer

A quick correction to the top answer by @PatomaS

"creating an account on Amazon to buy things, is worth the effort."

Amazon is an exception in the case of e-commerce.

When selling things a login just gets in the way. All you need is their email address.

The user can access orders using their email and order number and are sent a password if they want to sign in - but are not forced to. The card payment system asks for the information that is needed when it's needed, so again no login needed.

I first came across this method when working for John Lewis and have since worked on ways to avoid the users logging in. For regular users there is a way to login, but it's optional.

My view is that using LinkedIn/Facebook/Open Id/Insertsomethinghere login needlessly ties a site to system.

Logins are great if you're dealing with a bank or an online application where you private content is stored, but you don't have to say who you are in a physical shop, why do it with an online shop? I also am confused why I have to create an account to buy gig tickets. It's not needed and puts a barrier in the way of purchase.

share|improve this answer

protected by JonW Apr 6 at 6:25

Thank you for your interest in this question. Because it has attracted low-quality answers, posting an answer now requires 10 reputation on this site.

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.