Is delaying password setup after the signup a good thing?

Question

In order to reduce the signup friction on our website, we are planning to delay the need for the users to set their password to a later step by asking them only their email address at the moment they join the website.

The workflow would then be something like this:

1. A user signs up to the website entering his email address only
2. We create a temporary password for him in the backend and use this password to log him in. The user can thus use the application as normal.
3. We email the user a link that he will use to set his password later. This email serves also as a mean to confirm that the user's email address is correct.

I can't think of any drawbacks of using such a workflow but as it's not the standard we see elsewhere, am I missing something?

Answer 1

While it's good that you are considering minimising the requirement of the user to create and account and login, as Harshal mentions, the initial question has to be what does giving authenticated access allow this user to do and would someone supplying fake details then have access to an area of the site that could elvate the opportunity for malicious actions. Remember every point of user supplied content is a security risk. (This is now another area of Stack Exchange.)

However I would suggest you need to at least confirm the email address, send a limited time token email with a direct access link in, then as part of the current visit ask the user to change their password. I would recommend against sending this request in an email as this would simulate phishing and should not be encouraged or normalised.

If there is a need to populate more user data you can send the user requests for this in an email after the initial or subsequent visits, but don't send any login requests as above.

The actual process you choose should be mapped against expected user journeys/stories that show the full lifecycle of the users off and online experience.