Would a user authentication flow like this be a bad UX?

  1. User enters email address and clicks submit button
  2. User checks his email inbox and clicks on the link
  3. User is logged in
  • 1
    User experience is often subjective to the prior expectation or assumptions that is made about a particular flow, so rather than asking whether this is good or bad UX, it is probably worth trying to explain what this authentication workflow is trying to address. Often design rationale can be conflicting, such is the case when you are trying to make the application/system as secure as possible but also use only a minimal number of transaction steps. – Michael Lai May 17 '19 at 3:57

Aside from the security issues, usability will be poor. Users do not like checking email to log into websites, as demonstrated by low two-factor authentication adoption rates.

While I have not rigorously collected data, there is a clear trend. Two factor is not good UX. The reason for its use is security. When there is no security benefit, two-factor becomes a pointless hurdle.

  • I could do a five-user usability eval of two-factor vs normal login and 4-5/5 will comment about how much more effort two factor requires and ask whether it's necessary.
  • After orientation for software using two-factor, someone inevitably complains about how troublesome two factor is.
  • When explaining two factor to people, they explicitly decline saying it's too much trouble.
  • Etc.

The described "authentication" protocal is susceptible to man in the middle attacks. If you don't immediately understand why, you should not be trying to design your own authentication protocol. Any homebrew algorithm or protocol, even by those who understand what they're doing, is likely to be insecure. Even experts carefully vet their work via extensive testing and peer review.

Emails are passed from server to server in plain text. Even if the protocols have been updated to use encrypted links, emails are still inherently plain text. Anyone with access to the email, such as the email service provider and every server that the email passes through, can access the account. That is why you shouldn't send passwords by email.

What about two factor authentication? These require logging into the account with the appropriate credentials (login/password) before a verification code is sent by phone or email. Then the verification code is typed into the already logged in account. In some cases, the password is required again, along with the verification code.

What about password resets? These usually require some non-password identity verification. Lists of personal questions that only the original account holder is supposed to know the answer to. In practice, these aren't very secure because information, such as mother maiden name, are often public record. However, they are better than the design in the question, which requires only the email address, which every spam bot has access to.

What about logging in via a third-party account, like Google or Facebook? I haven't looked into the protocols, but at the very least, you are opening up your account to access by the third party. For something like PayPal or Banking, I'd recommend against third-party login. For something like social media, it may not matter as long as you don't further connect them to anything critical.

What about cookies and persistent logins? As long as the protocols are appropriately secure, cookies should be resistant to man-in-the-middle attacks. However, if someone is able to copy the cookies, accounts would be compromised. That is why banking sites tend to have annoyingly short timeouts.

This answer has nothing to do with UX. You're free to do whatever you want. But what good is an authentication protocol that doesn't authenticate? What good is a self-flying plane that flies itself into the ground? Sometimes, UX extends beyond the immediate task. For instance, I'd rather put up with annoying banking interfaces than have my accounts stolen and drained.

Yeah I knew all that. I'm not here to argue about the security trade-offs.

It's concerning that you would intentionally design an insecure system.


Yes, this will be bad UX. One option might be to use authentication via Google or similar account.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.