11

I came across this question in a closed LinkedIn group. I think it's a great one and since it's hidden from search engines, I decided to bring it to the outside world.

Some users don't visit your website/application as frequently as others and are bound to forget their login credentials. When accounts are created with a simple username-password combo, you offer the Forgot your login details? option.

However, what do you do when you also use 3rd-party authentication APIs (e.g. OAuth or OpenID)?

  • What is the most effective way to help returning users remember the service they used to create their accounts?
  • How do you prevent them from creating a duplicate account via another authentication service?

I realize the answer might be more technical than design and might have include some back-end code. If that's the case, please simply link to the documentation and don't post the code here.

Improve this question
1
  • Some sites I've seen don't care: if I register with email and then try to log in with Facebook, it just works. If I register with Twitter and then try OpenID, it just works. This is because all services eventually use email to identify someone, so you can always trace things back there if you architect your account systems correctly. I think this could be ideal, but there's still the question of how to address user confusion in the first place.
    – Rahul
    Mar 3, 2012 at 20:21

2 Answers 2

Reset to default
5

Well I found this interesting article from Luke Wroblewski https://bagcheck.com/blog/02-design-solutions-for-new-log-in-problems

Essence:

enter image description here

enter image description here

enter image description here

Ideally, there is a nifty way that the "Forget how you signed up, Enter user name: - This is in sync with existing patterns and it looks best to start with. Next, Step 2 -is what my concern area where on typing "Luke" it provides a auto-populated results, which is against privacy, and I do recommend that to be a simple plain text box. Step 3, is cool that it brings only the related Sign-on engine and takes away unwanted buttons or platforms.

This certainly address the issues that is existing with SSO.

Improve this answer
3
  • 3
    Though I like this approach,I am concerned about the potential security implications that might arise with exposing a person's name and picture (assuming they have assigned a picture to their name) to everyone
    – Mervin
    Mar 9, 2012 at 6:07
  • yeah, Security implications do exist by posing their photos, but leave alone and alternate it with a normal text box, as in any site - which should be the right way. Dozen of people also on the site has brought in the same query. Agreed!
    – inkmarble
    Mar 9, 2012 at 6:11
  • 4
    Nice idea, but names are not necessarily unique, how does it deal with the John Smith problem?
    – dbkk
    Mar 9, 2012 at 6:44
1

Here is what I can think of:

What is the most effective way to help returning users remember the service they used to create their accounts?

You need to constrain first, when you can expect them back, one-week/a fortnight/a month? Based on that, you can put a cookie in their browser.

How do you prevent them from creating a duplicate account via another authentication service?

You application's back end system should have one-to-one mapping with the unique information shared by the user. For eg: the twitter handle to the user's email id. This way's when they try to register with that same email twice, your application logic can prompt them that they might be already registered.

Digressing...

This is what can be done at the application level, although this seems like a perfect use-case where all these be collated together by Open-ID/any-other-3rd-party-api to track the website/service/username combination, something like a global single sign on!

On second thoughts. the email provider with whome we register, already has this information in our inboxes. So a simple browser plugin that searches all possible mailboxes, for a given website name, for words like [welcome/login/passwords], can resolve the problem at individual level.

Improve this answer
3
  • What will the cookie do? How can the application match Twitter authentication token with a Facebook authentication token? What are you talking about when you mention email providers?
    – dnbrv
    Mar 3, 2012 at 19:05
  • 1/Cookie will be set on behalf of the site as: username | 3rd_patry_service. When the user comes back on the site, the site checks for cookie and will prompt with the relevant twitter/FB logins and redirect back to the website. 2/Say I am registered with my [some]mail account on 10 websites. That [some]mail account would have emails from these 10 sites when I registered about my first timer login information. So a simple plugin that can search my [some]mail account for one of the 10 websites I am registered on for keywords mentioned in the earlier reply.
    – A'n' User
    Mar 3, 2012 at 19:22
  • Say I'm registered on Google with my Gmail account but on Twitter with my Outlook.com account. I sign up for a service using my Twitter account. Then I come back and try to sign in to the same service with Google.
    – Damian Yerrick
    Jun 12, 2015 at 21:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.