3

I'm on the fence in regards to whether I should implement user accounts or secret URLs. There are pros and cons to both, and I'm currently leaning in favor of the secret URLs because of the simplicity:

  • Doesn't require email
  • No registration and password recovery logic to implement
  • Immediate results for the user without having to register
  • Don't need to hash/salt user passwords and cache tokens
  • Since the website is seasonally used, it's likely that users would forget the email/password they signed up with every year when they need it

Potential problems:

  1. Each address may only have one advertisement, so if a user irresponsibly loses his secret link against all warnings (didn't bookmark it, or didn't sync/backup his bookmarks), he'll be permanently locked out of editing his ad, and denied from creating a new ad for his address.

  2. The secret URL would be in a user's bookmarks and/or history, so it would be their responsibility to encrypt their storage and lock their session as appropriate. If the URL is shared or compromised, there may be two guys fighting over this ad undoing the changes that the other person makes, and there's no objective way to prove who the real owner is.

I'd like to hear from people who've implemented the secret URL method, is it not as good as it seems? Can I expect users to save it in their bookmarks and never lose it? The two problems above obviously wouldn't be my fault, but would eventually fall under my responsibility to resolve in any case, so how would I go about preventing them from happening? (It can be easily worked around by allowing multiple ads per address, but that opens a new can of worms i.e. spamming multiple ads)

  • 1
    Have you considered a "No Password" approach? Don't have a password, only require an email. Send a temporary secret URL to the email and set a long living cookie once the secret url is opened. This way you still have a recovery option and still don't require a password. – Kempeth Apr 12 '17 at 11:35
1

You can't really get away with saying "it's not my fault" that users will lose their secret links when you made a conscious choice to implement that approach. :P

From what you've said so far, it seems like secret links is not a great fit for your product. As you've pointed out, it's very likely that people will quickly lose track of the link. When they do, it's not really their fault - it's just human nature. It's a pretty unorthodox method of authentication, so even with "warnings" people will be easily confused.

The biggest downside though is how massive the consequences are for a relatively simple mistake, which is a HUGE red flag in UX design. The barrier to people accidentally forgetting/losing the link is so low that it's VERY likely to happen. And once they do, it's irreversible - BOOM, permanently locked out of their account. That's bad.

The traditional email address/password combo, on the other hand, has huge benefits over a secret link:

  • People are almost guaranteed to remember their email address which makes log-in easier
  • Consequences of forgetting the password are very low - just email a reset link
  • Provides a better feeling of security (and probably actually more secure) than a secret link
  • Most browsers will automatically remember email/password logins, making it easy for users to log in
  • Just VASTLY more common, easier to grasp, and orthodox than secret links as a control panel

You're designing your product for your users, so while I understand the temptation to design the "simplest" system possible for your own sake, in this case you really need to take a hard look at what will serve your users best, and I think that it's a traditional email/password login control panel.

  • They may forget which email they signed up with. For example, if they want to allow their business partner to edit a specific one of their ads, they may have to create a new temporary email address to create a new account and share that account for just one address. Whereas with URL's, they create a new ad, copy-paste the URL in a chat message, and they're done. – dvtan Apr 10 '17 at 20:45
  • I didn't try to get away with anything, notice how I did say it would be my responsibility even though it's not my fault. But no matter - the second point I just thought of is that I could allow the user to enter their email address to automatically get the secret link emailed to them so it's permanently archived in their inbox. – dvtan Apr 10 '17 at 20:47
  • @dtgq What you just posited as an advantage of "secret link" over "email" is actually... not. Because I could also say that they could simply write down the email address they used for the account, or "copy-paste the email in a chat message." So it's not really an advantage as it could apply both ways. Plus, on the whole users are very likely to simply re-use an existing email address. And even if they don't, email addresses are much more memorable to users. – jered Apr 10 '17 at 20:48
  • 1
    If people need to share control of ads or have some other functionality, that should be addressed as a separate layer from control panel login/authentication. – jered Apr 10 '17 at 20:49
  • I did write the code for user profiles that would allow an ad owner and multiple editors, but that layer of complexity is too far ahead of the curve for a startup and may end up having bugs or security flaws. It's a ton of logic to keep in my head all the time.... decided against it and scrapped over a month of work. Users may not even understand how the logic of that layer works. – dvtan Apr 10 '17 at 20:50
0

I think it is a matter of a compromise between security and ease of access.

I would go for User accounts whenever these are reusable and guard access to more complex functionality a User would want to access and operate multiple times, especially when there is personal or confidential data behind it.

I would consider using hashed links though, whenever creating an account would be just too much for your Users and especially: if it affected conversion but only if the action they perform in the system is just singular, and there is no confidential data.

What you could consider, though, would be relaying on an external authentication provider such as logging in with Google or Facebook accounts or sending a one-time credential to the registered email address whenever they want to access their personal area. For example, upon trying to edit an ad, they would be sent a unique link only valid for some short period of time that would allow them to access it. This way you would avoid a risk of the URL being forwarded to someone because accessing an ad would require from User having the access to the email address used when creating the ad.

  • What do you mean by hashed links, I suppose some kind of information would be encoded into and could be decoded from the hash? – dvtan Apr 10 '17 at 20:57
0

Specifically I would consider implementing Auth.0 Passwordless and their "Magic Links"

https://auth0.com/passwordless

This would give you a lot of account management power and would tie user's access to something they are less likely to lose season to season. The problem with unique URLs in my opinion is that users are not accustomed to managing access through bookmarks, it's a brand-new mode of operation completely outside of standard password manager workflows.

0

You just described complicated measure for the user to figure out which would simply be fixed with a login system. I think the approach here is implementing a really good "forgot password" flow. A lot of people can forget their passwords, but with a really good forgot password flow, that issue is fixed.

Unfortunately, all the ideas you laid out have huge impact on the user's experience on your application.

0

There are other downsides, especially as you mention months between accesses.

  • Users can easily change PCs/replace broken phones or whatever over that time.
  • They may even opt for a different browser, or be forced to use one by an employer/windows update.

    You can't assume that they'll be using any form of history sync, especially on work machines.

  • On the other hand if they are syncing their history, that URL gets spread wider than perhaps you'd like.

  • People actually aren't too bad about losing passwords because they know what password are for -- they're much worse at losing arbitrary strings. And they're really rubbish at keeping arbitary strings secure.

  • A reasonable backup for an important URL that's rarely used is to print it out and put it on the wall. Is that what you want? Your "secret" may not seems so secret to me.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.