What happens when users are given a secret URL instead of a username/password?

Question

I'm on the fence in regards to whether I should implement user accounts or secret URLs. There are pros and cons to both, and I'm currently leaning in favor of the secret URLs because of the simplicity:

• Doesn't require email
• No registration and password recovery logic to implement
• Immediate results for the user without having to register
• Don't need to hash/salt user passwords and cache tokens
• Since the website is seasonally used, it's likely that users would forget the email/password they signed up with every year when they need it

Potential problems:

1. Each address may only have one advertisement, so if a user irresponsibly loses his secret link against all warnings (didn't bookmark it, or didn't sync/backup his bookmarks), he'll be permanently locked out of editing his ad, and denied from creating a new ad for his address.

2. The secret URL would be in a user's bookmarks and/or history, so it would be their responsibility to encrypt their storage and lock their session as appropriate. If the URL is shared or compromised, there may be two guys fighting over this ad undoing the changes that the other person makes, and there's no objective way to prove who the real owner is.

I'd like to hear from people who've implemented the secret URL method, is it not as good as it seems? Can I expect users to save it in their bookmarks and never lose it? The two problems above obviously wouldn't be my fault, but would eventually fall under my responsibility to resolve in any case, so how would I go about preventing them from happening? (It can be easily worked around by allowing multiple ads per address, but that opens a new can of worms i.e. spamming multiple ads)

Answer 1

You can't really get away with saying "it's not my fault" that users will lose their secret links when you made a conscious choice to implement that approach. :P

From what you've said so far, it seems like secret links is not a great fit for your product. As you've pointed out, it's very likely that people will quickly lose track of the link. When they do, it's not really their fault - it's just human nature. It's a pretty unorthodox method of authentication, so even with "warnings" people will be easily confused.

The biggest downside though is how massive the consequences are for a relatively simple mistake, which is a HUGE red flag in UX design. The barrier to people accidentally forgetting/losing the link is so low that it's VERY likely to happen. And once they do, it's irreversible - BOOM, permanently locked out of their account. That's bad.

The traditional email address/password combo, on the other hand, has huge benefits over a secret link:

• People are almost guaranteed to remember their email address which makes log-in easier
• Consequences of forgetting the password are very low - just email a reset link
• Provides a better feeling of security (and probably actually more secure) than a secret link
• Most browsers will automatically remember email/password logins, making it easy for users to log in
• Just VASTLY more common, easier to grasp, and orthodox than secret links as a control panel

You're designing your product for your users, so while I understand the temptation to design the "simplest" system possible for your own sake, in this case you really need to take a hard look at what will serve your users best, and I think that it's a traditional email/password login control panel.

Answer 2

I think it is a matter of a compromise between security and ease of access.

I would go for User accounts whenever these are reusable and guard access to more complex functionality a User would want to access and operate multiple times, especially when there is personal or confidential data behind it.

I would consider using hashed links though, whenever creating an account would be just too much for your Users and especially: if it affected conversion but only if the action they perform in the system is just singular, and there is no confidential data.

What you could consider, though, would be relaying on an external authentication provider such as logging in with Google or Facebook accounts or sending a one-time credential to the registered email address whenever they want to access their personal area. For example, upon trying to edit an ad, they would be sent a unique link only valid for some short period of time that would allow them to access it. This way you would avoid a risk of the URL being forwarded to someone because accessing an ad would require from User having the access to the email address used when creating the ad.

Answer 3

Specifically I would consider implementing Auth.0 Passwordless and their "Magic Links"

https://auth0.com/passwordless

This would give you a lot of account management power and would tie user's access to something they are less likely to lose season to season. The problem with unique URLs in my opinion is that users are not accustomed to managing access through bookmarks, it's a brand-new mode of operation completely outside of standard password manager workflows.

Answer 4

You just described complicated measure for the user to figure out which would simply be fixed with a login system. I think the approach here is implementing a really good "forgot password" flow. A lot of people can forget their passwords, but with a really good forgot password flow, that issue is fixed.

Unfortunately, all the ideas you laid out have huge impact on the user's experience on your application.

Answer 5

There are other downsides, especially as you mention months between accesses.

• Users can easily change PCs/replace broken phones or whatever over that time.

• They may even opt for a different browser, or be forced to use one by an employer/windows update.

  You can't assume that they'll be using any form of history sync, especially on work machines.

• On the other hand if they are syncing their history, that URL gets spread wider than perhaps you'd like.

• People actually aren't too bad about losing passwords because they know what password are for -- they're much worse at losing arbitrary strings. And they're really rubbish at keeping arbitary strings secure.

• A reasonable backup for an important URL that's rarely used is to print it out and put it on the wall. Is that what you want? Your "secret" may not seems so secret to me.