6

Does anyone know of a good alternative to the Forgot Password link on login forms? I'm not looking to eliminate the link, but to provide an alternate method for retrieving lost passwords.

Our current process works like this: 1. User clicks on "Forgot your username or password?" link, which appears below the Username and Password fields on our login screen; 2. A panel opens below this link asking the user to provide her email address; 3. A reminder email is sent to the validated email address, which contains a reset link.

The trouble is that many users don't remember which email address they used to register. Entering an unrecognized email address will pop an error message. So, I was wondering if it might be helpful to ask for an email address or a phone number? If a recognized phone number were provided, a text message could be sent to the user's phone with the reset link.

This alternative might help reduce the number of calls our customer service reps have to answer each day about lost passwords. But I haven't seen this phone/email pattern used before.

Any thoughts, pro or con?

4
  • Popping up a message on entering an unregistered e-mail address is revealing information you may not want revealed (to someone trying to hack into your site or a specific user's account). Just report that an e-mail has been sent to the given address. If the address does not exist or is invalid - nothing will happen and no information is inadvertently revealed. Aug 15, 2012 at 7:14
  • Good point, maybe we'll eliminate that error message.
    – RobC
    Aug 15, 2012 at 22:18
  • I'd keep the address. It's much more likely that a person will mistype email address. Getting an "all is well" notification from the site would help someone make that mistake. Sometimes it can take up to 3-6 minutes for an email to be received legitimately, so a person might make the mistake and then sit around waiting for an email that never comes.
    – Voriki
    Nov 24, 2012 at 19:05
  • An email with a reset link has been sent to v**********[email protected] also works
    – PirateApp
    Dec 16, 2017 at 11:19

2 Answers 2

3

I think you would be able to do this. In fact twilio can handle the reset password by voice if they don't have text.

2
  • Interesting. Do you know how reliable it is? Voice recognitions still seem to suffer from low quality. Aug 14, 2012 at 21:12
  • @AnnaRouben I'm not sure if we're on the same page, but not authenticate the voice of the user, but have the system call and tell them the reset password. I've tested it before and the voice is pretty clear. Around the quality of Siri. Aug 14, 2012 at 21:51
0

I think it depends on which user information your company collects from the users. Do you collect account recovery questions or alternate email addresses? You could for example ask for the alternate address and if there is a match ask for more information; for example, expose the last digits of the phone number and ask to provide the rest. Unfortunately our technology world didn't come up with the ideal identity solution yet. For the customer service reps, I would recommend giving them a quick ability to reset user's password. Usually service reps cannot know the new password or ask users for passwords so an auto generated reset password link can be sent to the user's email.

1
  • We don't ask for security questions, or alternate email addresses. Phone numbers are optional. Fortunately, the customer service reps can reset user's passwords.
    – RobC
    Aug 15, 2012 at 22:21

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.