7

I'm just wondering if we really need to remember or note down all the passwords we use for sheer amount of applications nowadays. Why can't a user just click on forgot password every time he wants to login? This solution does exist for mobile apps where user gets a OTP whenever he wants to login without getting asked for a password.

A system generated password is more secure than random user generated. Although, there are some disadvantages like a) Few of the applications doesn't generate random keys but force user to reset password. b) Resetting a password is complicated and time consuming in bank sites as it takes good amount of time to reflect or you may have to visit the bank in person (esp. in India)

I do follow this practice quite often but I'd like to know if anybody else follow the same pattern. Or is there any research down on this topic so far. Any thoughts?

EDIT 1: Adding more information

  1. I want to know if anybody has done any user testing or any case study available?

  2. I'm looking for communities's thoughts. Would they try forgot password link rather than storing the password after reading this question.

  3. How many people use this option[again it is open ended]

EDIT 2: Few of the commenters suggesting password manager but I feel they are costly for individuals and security issues would always be there.

  • It's a good question. Basically logging in = being able to access a reset email sent to a linked email account. Why bother with changing the password at all ? And remembering hundreds of passwords becomes increasingly difficult for people. – PhillipW Oct 12 '16 at 10:50
  • 1
    Yahoo and Google have started testing a "sign in with phone" system. It is also worth noting it may take longer to check email/phone, type access code and get access to a system than it does to type a remembered password. – Eldarni Oct 12 '16 at 11:15
  • Why would you need to type in an access code - If you can click on a link in an email is that not sufficient ? – PhillipW Oct 12 '16 at 13:59
  • 1
    I do this for sites I use rarely. I go straight to the forgot password link and use a password generator to create a new random password and then never commit it to memory. – Andre Dickson Oct 12 '16 at 14:13
  • @RickyBaby, sign in with phone is good option but it has dependency with phone.Frankly speaking it annoyed me when i'm accessing bank website on computer and I get OTP on phone which may be not around at that moment or many other reasons. I second with PhillipW on click on a link. – Hemchandra Oct 12 '16 at 16:27
1

Have you checked out password managers, such as 1password or LastPass? They are solutions specifically created for this problem.

If you are thinking about building your own product login around the forgotten password thing - I think that is quite interesting. I would love to see some prototypes around this.

It sounds like the main question is how user would verify themselves without password? Maybe 2-factor authentication is something you could look into, for example Authy does interesting things in this space.

  • Do you really think it is a good idea to store all the password with third party? I'm not creating any solution because i think all we need is to change the user's behaviour. – Hemchandra Oct 12 '16 at 16:31
  • @Hem Well made password managers are very secure and are certainly recommended in the security community as it allows users to create long (16+ character) randomized passwords and not write it down on a post-it everyone could see. – DasBeasto Oct 12 '16 at 16:59
  • 1
    Also the actual passwords are stored in a "vault file" that you can store on your own computer or if you'd like on your dropbox-account (easier to access with your phone). You also have to have the master password to open the file, so if someone steals the file, it is still not easy to get the passwords. Using password managers is considered way better practice that using for example the same password in multiple services, because if someone gets their hands on that one password, they can get into all of your accounts. – Satu Oct 12 '16 at 17:58
  • this brings a very nice UX question on my end if you dont mind answering, i am making a login form right now and i saw that lastpass has an affiliate program, what if I could hypothetically detect if the person has lastpass installed and add a link in the form saying "I am tired of entering passwords" which takes people to the lastpass affiliate link – PirateApp Dec 14 '17 at 12:58
1

(I should start by saying that this question is probably too opinion-driven / not quite StackExchangy. I feel like you're asking for people's opinions more than for policies that provide optimal UX.)

The bulk of problems associated with passwords have been described by Angela Sasse as The Great Authentication Fatigue. Issues with passwords include: (a) the effort of logging into a system very frequently (e.g. 20 times a day), (b) infrequently used passwords, which are forgotten, (c) password creation requirements, leading to difficulty in creating and recalling passwords, (d) password expiry, which wastes users' past efforts to create good passwords.

Not investigated there, but in other studies, users do have too many passwords, leading to memory interference when recalling a single password. Florêncio et al. have shown in Password Portfolios and the Finite-Effort User why password re-use and weak passwords are useful to users: they just have too many passwords to remember for all of them to be strong and unique.

The most tangible solutions to this problem are password managers and federated authentication schemes.

Password managers reduce the number of passwords you need to remember by storing them for you, but they can introduce maintenance costs, and dependability on an online service or a specific device that stores passwords.

Federated authentication schemes rely on authentication providers like Google, OpenID or Facebook to authenticate you without having to manage any secret authentication factor. They introduce privacy risks as the service providers might use your authentication events to track you, and they also place a trust bond on these providers as they are able to access your accounts unbeknownst to you.

There are no other tangible solutions to this problem. Absolutely none of the evaluations for alternatives to passwords provide credible evidence that these alternative schemes wouldn't suffer from the same issues as passwords when applied at a large scale. The only effort being developed to replace passwords that considers real-world scale is Pico, which is still being developed and evaluated.

  • 1
    yes i'm looking for user's opinion because opinions are driven by behaviours/experience in a specific environments. And that is all UX, considering the opinion is well informed. Also, thanks for sharing wonderful resources. But my question remain unanswered, why can't forgot password link be a optimal solution than password managers? It is cost/time effective. Also, nobody would be intersted in using using google/facebook login for financial applications. – Hemchandra Oct 12 '16 at 16:41
  • It is, in practice, how many people deal with unfrequent passwords. There might be some answers to that in some of the papers from Sasse, especially a study co-conducted between NIST and UCL. But I'm not sure if any paper mentions and quantifies those behaviours specifically. It's not exactly an ideal method, though. You still have the issue of delays with emails and having to load up another platform. For some users, getting OTP tokens via text might be nicer. But there is no evaluation of how different mechanisms fare for logging in quickly after a password loss. – Steve Dodier-Lazaro Oct 12 '16 at 17:44
  • What's really annoying is how one can start being a net user with a 5 digit standard password...and then sites start demanding a 6 digit password (so you have to make up a second one)...then they want a number in it...and then they want a capital letter in it... and then they want a strange character...so you end up with a whole set of 'standard' passwords and can't remember which one you used ! (Standard passwords being for sites which you really couldn't care if anyone accessed your login) – PhillipW Oct 19 '16 at 11:56
  • @PhillipW yeah, I've seen with my participants that they tend to have multiple default passwords, including a simple, quick one for when there are no requirements, and one that is likely to meet all common requirements. – Steve Dodier-Lazaro Oct 19 '16 at 14:23
1

Security

One issue is security. If you're not going to remember you're password then the application is going to have to give you a new one, whether it be by email or sms.

Email - Email is inherently insecure. Any email can be intercepted, if you generate a strong password and email it to the user as a one time password an attacker can gain access to that password and breach your account. Even if you generate a quickly-expiring hashed-token password reset link a user can intercept it and gain access to your account.

Sms - Nope, no better solution here SMS is also insecure. So as mentioned with email, any attempt to send the user a way to verify their identity can be used by theirs to impersonate their identity.

Sure, there are OTP apps that use these techniques, and for the most part their users will be fine, but when security matters these techniques will not compare to having a strong password (and remembering it).

Alternatives? Sure you can make your OTP application more secure, but your going to have to find a way for the user to get their new password securely. This is where OTP token generators like this come into play. They allow users to generate their own tokens that communicate securely with servers allowing the user to sign in without insecure passwords ever being transmitted.

However, whats more difficult, buying each of your users a hardware authentication device or telling them to remember their password?

  • What about sending a link to user and validate user once he clicked on it. – Hemchandra Oct 13 '16 at 3:07
0

If I, a system developer, rely on access to an email account to make proof that someone is the legit account holder of an account registered in my system then I really don’t need the user to register a password with me. We can all rely on an respectable internet player to authenticate users (like Google, OpenID or Facebook) and we don’t need to compromise privacy or anything. It would be sufficient to ask this authority if thisemail@gmail.com is really him or not. It’s just like asking someone of authority if John is really who he says he is. I think this is good UX because it alleviates the effort to access a system without compromising security.

0

I quite like the way Medium handles the log in process. As well as using all the social networking methods to log in, you can also request a log in link sent to your email that you click to log in. No need to remember password etc. This could probably get annoying for something you log into often through out a day e.g. banking etc, and with something so sensitive there's probably big security concerns too.

On that note, with things like TouchID becoming more prevalent - it's going to cause a lot of people to forget their actual passwords should they ever have to log in 'manually'!

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.