4

Is it a good idea to only require an email address from users at signup (without a password or other details)? After they sign up, we will send a random password to their email address; this password can be customised after the user logs in.

Are there any possible downsides to doing this?

Improve this question
17
  • 4
    If you were to take this approach I would recommend that you get the user to change the password immediately to something more memorable.
    – Wander
    May 23, 2012 at 9:42
  • 5
    your recent question asked about sending passwords in email, to which it was shown this is a bad idea. Are you still considering sending passwords via email?
    – JonW ♦
    May 23, 2012 at 10:00
  • 5
    @SarawutPositwinyu sending any password in plain-text, regardless of whether it will be changed or not later is a bad idea.
    – JonW ♦
    May 23, 2012 at 10:21
  • 2
    @SarawutPositwinyu it does not require email to be cracked by an attacker. Email is copied across a(several) network(s), with multiple machines handling it by its very nature. You might as well be mailing it to them in a clear envelope.
    – Joshua Drake
    May 23, 2012 at 14:09
  • 2
    @BenBrocka so you are okay with a random person setting the password for your accounts?
    – Joshua Drake
    May 23, 2012 at 14:10

7 Answers 7

Reset to default
15

Emailing the password exposes it, since it is sent as unencrypted text.

  • If you do email the password, make sure the user changes it during the first login.

  • Alternatively, you could send a link to a continue page where the user can choose a password. This link has to have a time limit, since the link is also sent as unencrypted text.

    You can use the same technique for resetting the password if the user forgets it.

Even if you do ask the user for a password during signup (this is the most secure out of the two options), sending an email for confirming the email address prior to enabling the account is a good idea (prevents others from signing up using your email address). This email should have a deadline (e.g. an hour or one day), so that the account will be cancelled if the email address is not confirmed. This will also enable signing up with the same user name but using the correct email address after the timeout.

Also, you may want to consider letting the user fill additional fields e.g. a display name or user name either before sending the email or after the email has been received.

Improve this answer
17
  • 9
    @ADO: The people from 4chan do this all the time for fun, and post fairly believable stories impersonating the user, such as saying that they are leaving their wives because they are gay, or - always impersonating the user - posting child porn pictures and then saying "whoops I posted the wrong picture how do I delete this??", etc. This can be very harmful to a person's reputation. Keeping blogs, dating websites, facebook and the like secure is of extreme importance.
    – Andreas Bonini
    May 23, 2012 at 13:36
  • 1
    +200 for the security comments, plain text passwords are always the wrong choice. -1 for email verification since we are talking about user experience and email verification always adds to the length of the registration process. Additionally, for me, it feels like they want to be able to spam me later making me more likely to not sign up or use a fake email address; yes I can give a fake email address and still verify it.
    – Joshua Drake
    May 23, 2012 at 14:05
  • 1
    @JoshuaDrake I keep getting emails from various sites that others signed up to using my address. I would gladly verify my email every time to prevent this. If the site asks for my email, it should verify it, if not then it shouldn't.
    – Danny Varod
    May 23, 2012 at 14:55
  • 2
    @ADOConnection you don't need to hijack an email account to read emails. Unless the sender and every email server the mail goes through use a secure connection, a man in the middle attack can be used to listen to emails going through the web. See this link for more details: en.wikipedia.org/wiki/Email_privacy
    – Danny Varod
    May 23, 2012 at 14:59
  • 1
    @ADOConnection - you're assuming that users will use different passwords for high and low security services, so that one password being stolen won't provide access to other services. That's a dangerous assumption.
    – Jimmy Breck-McKye
    May 30, 2012 at 1:01
6

Anything that reduces the friction in the sign up process is a good idea. If the user is presented with a form that requires more than a couple of seconds to fill in they're more likely to abandon the process. Only having one field to fill in is the ideal form in that respect.

Of course, the really important thing is it have something that the user wants to sign up for. Don't require sign up just to enter the site. That would guarantee that a lot of people won't bother.

As @Captain Spectacular points out make sure that the first thing they do when they do confirm their e-mail address/sign in is change the password. Otherwise they'd carry on using the generated password which might be a security issue (depending on how you generate and store the passwords).

If you can send a link to the "confirm e-mail and change password" page then that would be better as you are not then exposing either the users e-mail address or password (even if it is auto-generated) via a plain text e-mail.

Improve this answer
3
  • What you also need to consider is the value of what you are providing to the user. If they want it bad enough, they will be willing to fill in more information and won't abandon as easily and will lock into the process.
    – Wander
    May 23, 2012 at 10:31
  • @Captain - that was partly the point of my 2nd paragraph.
    – ChrisF
    May 23, 2012 at 10:34
  • I agree. Also, in case the user needs to enter a username, it could be good to just show that input first. When the username is confirmed as free, you could display a message "Congratulations! That name is free!", and then reveal email and password fields. That means they have made progress on the process of signing up and are less likely to give up.
    – Danik
    May 24, 2012 at 17:03
1

The ultimate ux is to require nothing :)

Ask yourself if your product or service actually requires a password. Is an email address enough on it's own? Does the data you capture with the email address need to be password protected?

Could you send the user a confirmation email and only ever require a password from them when it's necessary? When it is, ask them for one at the point. A password is minimal effort if the perceived reward is high.

In any case, a generated password will always be a design fail. I've seen enough numbers in my time to know that you'll have users hitting that forgotten password link 80% of the time. Leave the user to enter their own password, don't even generate one.

Improve this answer
1

I think this depends entirely on the context of the website, if for example you were building an e-commerce system and you wanted to streamline the sign up process so you can start building up analytics on that user as quickly as possible from a variety of cross platform devices that they access then an email address would suffice with a auto generated password.

Remember at this stage the user has no personal details stored within their account, they have only entered in their email address, and perhaps a name? The auto generated password / email would then force the user upon next sign in to change their password, you can hardcode the password into the link itself.

No information at this point could be considered to be 'dangerous' if it got into the wrong hands, and at this point the user is changing the password to one they feel safe and secure with.

However if at the sign in screen you are taking address, phone number, card details then auto-generating a password would un-secure and pointless, the user has already entered in a myriad of data, what would one / two extra fields be?

Would auto generated passwords work for banking, car loans or other financial services? No, for websites / accounts that have no personal information that could be used, yes.

Improve this answer
0

100% good idea. You may leave only one email field or add some not required fields (when user in a good mood, he likely to fill some extra data)

Improve this answer
3
  • Any constructive criticism?
    – ADOConnection
    May 23, 2012 at 21:01
  • I'm sorry I forgot to leave a comment. I thought as an answer that this was very poor. It's merely a short draft of your own opinion, with no reasoning what so ever. Own opinions without any factual evidence/reasoning to strengthen your case should exclusively be posted as comments, not answers. "100% good idea" is a very poor answer. That was why I voted this down.
    – AndroidHustle
    May 25, 2012 at 7:44
  • Ok, i'll note that for future answers, thanks for feedback.
    – ADOConnection
    May 28, 2012 at 15:55
0

I would say that in general the minimum should be email address and some kind of username. You generally wouldn't want to expose user's email address in forum posts, comments, etc.

Improve this answer
0

The general idea is good, as user will not need to remember the login. He or she ends up with the login already well known to him/her.

Two watchouts regarding sending password to the registered email: * it should be temporary (like: 10 minutes, for completing the registration) * or even better, you should just provide a link in the email to go to a page where user can set the password. You will need to provide activation link anyway, so perhaps this is the best situation.

Of course everything depends on the system, in some situations it may be necessary to provide additional data.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.