Do we really need to remember all the passwords?

Question

I'm just wondering if we really need to remember or note down all the passwords we use for sheer amount of applications nowadays. Why can't a user just click on forgot password every time he wants to login? This solution does exist for mobile apps where user gets a OTP whenever he wants to login without getting asked for a password.

A system generated password is more secure than random user generated. Although, there are some disadvantages like a) Few of the applications doesn't generate random keys but force user to reset password. b) Resetting a password is complicated and time consuming in bank sites as it takes good amount of time to reflect or you may have to visit the bank in person (esp. in India)

I do follow this practice quite often but I'd like to know if anybody else follow the same pattern. Or is there any research down on this topic so far. Any thoughts?

EDIT 1: Adding more information

1. I want to know if anybody has done any user testing or any case study available?

2. I'm looking for communities's thoughts. Would they try forgot password link rather than storing the password after reading this question.

3. How many people use this option[again it is open ended]

EDIT 2: Few of the commenters suggesting password manager but I feel they are costly for individuals and security issues would always be there.

Answer 1

Have you checked out password managers, such as 1password or LastPass? They are solutions specifically created for this problem.

If you are thinking about building your own product login around the forgotten password thing - I think that is quite interesting. I would love to see some prototypes around this.

It sounds like the main question is how user would verify themselves without password? Maybe 2-factor authentication is something you could look into, for example Authy does interesting things in this space.

Answer 2

(I should start by saying that this question is probably too opinion-driven / not quite StackExchangy. I feel like you're asking for people's opinions more than for policies that provide optimal UX.)

The bulk of problems associated with passwords have been described by Angela Sasse as The Great Authentication Fatigue. Issues with passwords include: (a) the effort of logging into a system very frequently (e.g. 20 times a day), (b) infrequently used passwords, which are forgotten, (c) password creation requirements, leading to difficulty in creating and recalling passwords, (d) password expiry, which wastes users' past efforts to create good passwords.

Not investigated there, but in other studies, users do have too many passwords, leading to memory interference when recalling a single password. Florêncio et al. have shown in Password Portfolios and the Finite-Effort User why password re-use and weak passwords are useful to users: they just have too many passwords to remember for all of them to be strong and unique.

The most tangible solutions to this problem are password managers and federated authentication schemes.

Password managers reduce the number of passwords you need to remember by storing them for you, but they can introduce maintenance costs, and dependability on an online service or a specific device that stores passwords.

Federated authentication schemes rely on authentication providers like Google, OpenID or Facebook to authenticate you without having to manage any secret authentication factor. They introduce privacy risks as the service providers might use your authentication events to track you, and they also place a trust bond on these providers as they are able to access your accounts unbeknownst to you.

There are no other tangible solutions to this problem. Absolutely none of the evaluations for alternatives to passwords provide credible evidence that these alternative schemes wouldn't suffer from the same issues as passwords when applied at a large scale. The only effort being developed to replace passwords that considers real-world scale is Pico, which is still being developed and evaluated.

Answer 3

Security

One issue is security. If you're not going to remember you're password then the application is going to have to give you a new one, whether it be by email or sms.

Email - Email is inherently insecure. Any email can be intercepted, if you generate a strong password and email it to the user as a one time password an attacker can gain access to that password and breach your account. Even if you generate a quickly-expiring hashed-token password reset link a user can intercept it and gain access to your account.

Sms - Nope, no better solution here SMS is also insecure. So as mentioned with email, any attempt to send the user a way to verify their identity can be used by theirs to impersonate their identity.

Sure, there are OTP apps that use these techniques, and for the most part their users will be fine, but when security matters these techniques will not compare to having a strong password (and remembering it).

Alternatives? Sure you can make your OTP application more secure, but your going to have to find a way for the user to get their new password securely. This is where OTP token generators like this come into play. They allow users to generate their own tokens that communicate securely with servers allowing the user to sign in without insecure passwords ever being transmitted.

However, whats more difficult, buying each of your users a hardware authentication device or telling them to remember their password?

Answer 4

If I, a system developer, rely on access to an email account to make proof that someone is the legit account holder of an account registered in my system then I really don’t need the user to register a password with me. We can all rely on an respectable internet player to authenticate users (like Google, OpenID or Facebook) and we don’t need to compromise privacy or anything. It would be sufficient to ask this authority if thisemail@gmail.com is really him or not. It’s just like asking someone of authority if John is really who he says he is. I think this is good UX because it alleviates the effort to access a system without compromising security.

Answer 5

I quite like the way Medium handles the log in process. As well as using all the social networking methods to log in, you can also request a log in link sent to your email that you click to log in. No need to remember password etc. This could probably get annoying for something you log into often through out a day e.g. banking etc, and with something so sensitive there's probably big security concerns too.

On that note, with things like TouchID becoming more prevalent - it's going to cause a lot of people to forget their actual passwords should they ever have to log in 'manually'!