0

So after doing some research on account recovery/lost password best practices we decided to require a backup email account for password reset. That's easy enough for new users, but I'm unsure how to message our existing users. It's going to be required and can't be associated with their employer (it has to be a private account).

Do I pop up a modal requiring them to add a backup email the next time they login? Do I prevent them from moving around in the app until they do it? How do I phrase the message? Can anyone point to any accessible screenshots of someone who did it well?

As always, I really appreciate the advice.

1

You present a very interesting problem - how to get your existing users to essentially complete one more step in the "sign up" process

The least painful way I can think of - whenever they log in next, they should be informed about this. So that would mean that you have to wait for all users to log out at some point of time, and go through the log in process. That too, I would make it optional and not forced for the first time.

If your message is worded well, and brings across the seriousness of the requirement, I believe most users will be OK with it the first time. For all others, you keep reminding them on login. If that doesnt work, then keep reminding them after login too. If it still doesnt work, then make it mandatory one fine day for the users who refuse to accept.

  • "For all others, you keep reminding them on login. If that doesnt work, then keep reminding them after login too. If it still doesnt work, then make it mandatory one fine day for the users who refuse to accept." This is exactly what we tell our students NOT to do. Antagonising users for something like security (which they do not always value and almost never prioritise) is a good way to harm your business. – Steve Dodier-Lazaro Nov 12 '16 at 10:09
  • While I agree with you, that this might create bad experience for users, if the reminders are for things that arent of much value to the users. But I, for one, assume that this is a real need in this use case, and if it is, then there is no reason for users NOT to value this. I believe this is similar to how gmail, keeps reminding you now and then to add a secondary email, phone number, etc for password recovery. – JustAnotherPM Nov 14 '16 at 6:14
  • 1
    The key teaching of value-sensitive design is that it is not you or I who decide what the users value. It's the users. – Steve Dodier-Lazaro Nov 14 '16 at 10:05

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.