New answers tagged

3

Treat a transition from federated login to mail and password the way you would treat a self-service password reset. Send a message to the address with a one-time link to create a password. Then when the user follows the link, invalidate it and open the change password form.


0

If you do not handle e-mail confirmation expiration, someone could register with someone else's e-mail address and never confirm it which would lock the e-mail of the legitimate user if he ever wants to register to your website. If the user hasn't confirmed his e-mail address in the given length of time, you want to make it available again, ...


1

If clicking the verification link automatically logs the user in, then yes, the verification link should expire. Why? Because if the user's inbox is compromised a hacker can search for the verification email and then click the verification link to gain access to the user's profile on the website. The question then is, when should the link expire. Maybe not ...


1

There is an update to the blog post now with suggestions. Friction problems I use a hotmail account for all my random logins that I don't log into very often - so I would have to switch to another tab, login to my email, wait for the email - it can be 10-30s, switch tabs back to login to their website. Users with password managers, who can normally login ...


0

It's interesting thinking - but users forgetting which email address they used is a big part of the login problem in the first place. As a user of password managers, I agree I would feel penalised with the reset every time approach. The other issue is that emails get lost/spammed filtered and low-tech users have enough trouble with email as it is - ...



Top 50 recent answers are included