0

I'm creating an online service for companies to manage registration for annual events. Event attendees will need some way to login to the system to manage their booking, payment, special requests, etc. I expect attendees to login frequently close to the event date and completely forget about the service as soon as the event is over. That means I need to design a login workflow that accomplishes two seemingly conflicting goals

  1. Provides a smooth and easy login experience close to the event date. Normally I would use a user/pass, "remember me" option, or federated ID for this.

  2. Is easy to recover in the coming year when the user probably remembers almost nothing about the account. They may not know which e-mail address or password they used, they may have changed companies and not have access to an old e-mail, they may have a new computer, new IPs, etc.

Cross posted on information security: https://security.stackexchange.com/q/180003/13907

  • It doesn't necessarily have to be treated as a special case. I suspect that many people have a standard username/password combination that they use for this kind of website, so it'd be relatively easy to get back in, even after several months. OTOH, if you have their email address, you could always send a reminder email when it is time to re-register for subsequent events, subject to data protection rules (e.g. GDPR), etc. – Steve Jones Feb 18 '18 at 14:02
1

One solution that comes to my mind is what Doodle does: it sends you an email with a special "admin" link that lets you edit details. There's no sign up flow and you only need the link. Obviously, that decreases security, so you'll need to evaluate what the risks are. If payment info is not registered with you but with e.g. Stripe or Paypal and the biggest risk is that a hacker could switch a person's attendance on or off, then perhaps it's worth the risk.

Another solution that might work is letting people sign up with commonly-used accounts: Google, Facebook, LinkedIn, etc. If a company uses the G Suite, then the whole company can use Google sign-in and there should be no problems. Of course, you can't rely on people having these accounts, so you'll need to implement the standard email-based sign in/sign up process.

0

This happened to me last summer: bought tickets months in advance for a music festival, then could not find the link to print out the tickets. When I did find the link, I learned that I have several accounts on the third-party registration platform (EventBrite). Really annoying.

Try to leave as many markers and reminders as possible. So, as Tin Man suggests, provide a special admin link and allow login with Google and Facebook. Also, put a short explainer on the site of origin, something like "Where Are My Tickets for X Event?" wherein you provide links to the rego site, and other clues about login.

Maybe also provide a "share event details" link in the registration confirmation screen. Open Table does this for restaurant reservations. Or an "Add to Calendar" link that contains info about login and password recovery. For those of us who run our lives off of Google Calendar, this could be a lifesaver.

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.