I work in the digital team for a UK-based crime prevention charity. The charity has an online form where people can give information about crime anonymously, and they can chose when completing the form to create an anonymous login so that they can add details at a later point/answer other questions that we might have for them. I am helping a digital agency to redesign a) the form and b) the login system.

My primary interest at the moment is the login side of this project. Does anyone here have experience of creating a similar login system, or advice on improving UX for such a login system? High security systems can have UX as a secondary consideration but I think it's worth attempting to simplify the system we are current expecting users to go through.

Here is some useful background info -

Key requirements of the system:

  • Has to be secure, but anonymous (we don't capture email addresses, names, phone numbers or anything else that could identify the person giving information)

Current login system:

  • We ask for:

    1. Pass phrase (user created - at least six characters long and contain at least 1 numeric character, 1 capital letter and 1 special character (eg. &@%*?!))
    2. The user to remember an image they selected from a choice of 8 images
    3. The user to remember a colour they chose from a predefined list of 8 colours
    4. (optional) A unique code generated when the user sent the initial form


  • 1
    Does the system ask for any method of contact whatsoever? If not, just provide them with a "spy" name like "TangoFoxtrot007" (this ensures they don't pick a bad username like "EricksUpstairsNeighbor") and have them create a simple password.
    – invot
    Jan 25, 2018 at 17:39
  • The system doesn't ask for any contact method at all.Thanks for your comment - the concern I can forsee coming back from our Operations team is that people would use a screenname that they have used on other sites, increasing the likelihood of their discoverability. We take information about very serious issues and, if we get hacked and login details are leaked then there is a risk that someone's identity would be revealed. Jan 26, 2018 at 15:38
  • ^We haven't compromised anyone's anonymity in the 30 years we've been around but that's because we've mitigated the risk with systems like the one above (while no doubt giving users a headache!) Jan 26, 2018 at 15:50
  • 1
    I definitely agree with their concern. That's why I think it makes sense to have the site randomly generate their screen name.
    – invot
    Jan 26, 2018 at 15:51
  • I think that's reasonable. What about the image/colour based approach we use at the moment? How good are people at recall, really? Jan 26, 2018 at 16:00

1 Answer 1


The current systems looks very complicated and would easily put anyone from using.

This can be simplified to a randomly generated pass phrase and user's memorable date.

  1. Randomly generated passphrase can consist of a simple word and a date of crime report. For example: Apple20180126, or Mango20180201. If user finds this hard to remember, you can offer user to regenerate the passphrase.

  2. Could be a date that is easy to remember for a user, but can not be the same as the date of crime report. May be someone's dob for example. This date would be known to user only.

As per you comments, you can offer user to enter a passphrase only. This is sufficient to protect a crime report. Introduce a minimum input length and a rule (like a capital letter) for security purpose.

  • 1
    Yup. It's quite a unique situation - users are used to email/social logins etc. Problem is that a date that is memorable to one person may also be memorable to someone close to them: this may be the person they've sent the crime report in about. Say the user won't remember Step 1 (eg they're likely to forget when they reported the crime), they might write it down. If someone they live with finds this and looks at the user's search history they'll be most of the way to the login. If the perpetrator of a domestic violence incident got access to the user's report this could result in serious harm Jan 26, 2018 at 15:58
  • I have edited the answer to consider your comments. Jan 26, 2018 at 16:25
  • I haven't thought enough to think of something better, but using a "memorable date" doesn't sound right... someone's DOB is one of the more likely choices, and several people (especially in a domestic violence case) will know what it is.
    – TripeHound
    Apr 27, 2018 at 10:53
  • This is like with every memorable work/number/date - someone knows it. Same with the passwords. You can never guarantee that the victim will not give the information away due to threats or violence, but you can up the security by providing additional elements. i.e. enter the memorable date and pick an image. Which can be guessed, - you will say, but so can anything else. Apr 27, 2018 at 15:42

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.