Tag Info

New answers tagged

0

I realise you asked this question a few weeks ago, but products do get iterated, and perhaps this product is not yet released. With that in mind, in your shoes I would have asked the developer these questions: Is the user entering this password in a setting where others are watching? If not, why obscure it? Alternatively, allow the user to decide whether ...


2

In my opinion you don't want to put any strong focus on the forgot-password link. If someone's forgot the password, he will look for it. The important point is to integrate the link in the user's workflow. Mostly he excepts the link near the Login button. For convenience reasons I would place it as a link right next to the button OR right below. Another ...


8

This is a security antipattern It's not a good idea to let admins see a user's actual password ever. Users often use the same password for multiple sites (against better advice), so it's a moral hazard to allow admins to see user passwords. You don't need to see a user's password to change it. Showing a user's password on screen, especially in a web ...


0

You can have one "username" text input, whether it's a phone number with a country prefix or not, or an actual username or an email address, should be irrelevant, cater for all the cases that the user can enter it in behind the scenes and log them in if one is a match. Facebook does it so well, you can login with Phone number (international and local ...


0

Don't do it There are multiple reasons why: It worsens rather than improves users communication. Users confronting a signup form without a password field may wonder if their account is secure, wonder why there is no password, etc. By removing the field you are failing to communicate to the user that the account will be accessed via password....in fact ...


0

Email would require sending the password in the clear, which is a bad practice (especially if your site stores any personal or financial/payment information). This is why many websites have stopped offering to email you a forgotten password, now offering to email you a link to reset your password instead. (Another reason for this is that they don't even ...


0

This question could be reworded: Should users be prevented from choosing their own password on initial sign up? Best case scenario, you end up with a streamlined form with a higher conversion rate (people like simple forms) and users that all have strong passwords. This relies on that the users are going to stick with your generated password, which must be ...


0

That practice is confusing and frustrating for users not familliar with your system. Additionally i could imagine many people not knowing intuitively that they should change their password to their preferred one after logging in and they might forget about that email you sent them and register again out of confusion once they wanted to use your service ...


0

I think this depends on what you're signing up for, and whether the user is likely to return and need a password to log-in. For example, I once worked on a sign up process which sent the user an automated password in this way because whilst the website needed to collect the user's credentials for later correspondence, the user could, but rarely chose to ...


2

I think the key question is, do you need to verify the email address or not? I would only send an email for verification purposes or just a welcome message. If you really want to eliminate fields to fill in, you could start with name, emailadress and password. Then ask their other details in a later stage.


0

You could make the process kind of "asynchronous". I mean, let the user sign in and make him/her log in without the need to change the password immediately. In this way you don't "break the cycle". Regarding security, you could allow only a restricted set of privileges until the user clicks a link sent by email or changes the password.


0

I will have to wait for email. It breaks the flow, go to mail box, check for the mail. Sometimes wait for email. Anxiety!


12

The negative aspect is that you've inadvertently complicated the process. If I signed up and used my preferred secure password then I'm in and done. However with the auto gen password approach I have to get the email, click the link, go back to the email, copy the password "G34-zaopwf792hj" (cause I'm not going to attempt to re-type it) paste it in, then ...



Top 50 recent answers are included