2
votes
6answers
360 views

Is it necessary to verify a user's email address?

It's pretty much a fact that users hate having to open a new tab, go to their email service, log in, wait for the email to arrive and then click a link/paste a code. Is it really necessary to do this ...
2
votes
3answers
110 views

Forcing users to use a new password everytime they reset

This is getting common that while resetting one's password, web-applications force users not to use a password which they had used before. Just like forcing users to follow a particular pattern of ...
6
votes
3answers
273 views

What would be an expected behaviour for resetting the password?

When a user uses the »I forgot my password« link several times and gets a couple of emails, each one with a tokenized link to reset his password, what would be the appropriate behaviour? All links ...
10
votes
2answers
778 views

Email confirmation on password reset?

I am building a prototype to a system that has a user account system in place. Of course with any account system, the user should be able to reset their password should the need arise (e.g., ...
9
votes
3answers
784 views

Should password fields be blanked when inline validation fails?

This question with a similiar name refers to registration, but in my case, I would like to address submission. My use cases are: A login form consisting of a email address. A change password form ...
5
votes
4answers
1k views

Why do sites split 'password' and 'username' retrieval into two separate operations?

I find this way of doing it highly annoying when I come back to a site I haven't used in a while. First having to enter my email to get my username and then enter my username and email to reset my ...