Are we stuck with the "Forgot password" link?

Question

The convention for forgotten passwords seems to have stranded on the following:

1. Click a link under the Password input field saying "Forgot password"
2. Enter your email address and click "Send password"
3. Click the link in the email to create a new password.

I'm trying to think of a way to lose the "Forgot password" link. My ideas so far are:

• A) If the user logs in with the incorrect password, send him the reset password link.
• B) If the user logs in with no password, send him the reset password link.

The problem with A is that the user will get some unnecessary emails, if he just needs a few attempts at remembering his password by heart.

The problem with B is that you have to tell the user to leave out the password. And that quickly takes up more space than the "Forgot password" link.

(You could say after the first login failure: "Leave password field blank to create a new password". But would most people make at least one attempt at logging in before realizing they don't remember their password, or are their minds just blank from the start so they won't even have a go at it?)

Are we stuck with the "Forgot password" link, or can anyone come up with a better solution?

EDIT: The original post actually said "send password", whereas I obviously meant "send reset password link". How embarrassing :)

Answer 1

I can't see what is the goal here? To get rid of "forgot password" link? It is easy - make it visible only if the user enters incorrect password at least once.

The "forgot password" link is what the user knows and expects. Don't try to astonish him.

Answer 2

For starters, both of your solutions are bound for abuse. Anyone that knows your username could try to impersonate you and get your application to send a whole bunch of unsolicited emails. That means your users will think you're annoying and at this point they're less likely to use your application. Obviously, that's not good.

Unfortunately, us humans, in addition to our nefarious tendencies, forget things and passwords are probably one of the things we forget the most.

To answer your question, yes we are stuck with the "forgot my password" link. However, the issue doesn't really lie there, but rather in the complexity of said passwords. There is a very interesting answer that revolves around this idea on StackOverflow. Here's an important tidbit:

a passphrase with about 77 bits of entropy: "admit prose flare table acute flair"

a password with about 74 bits of entropy: "K:&$R^tt~qkD"

Answer 3

Two ideas, I haven't implemented them, nor have they seen scrutinity.

Get rid of the password

"Forgot password?" already binds your identity by access to your inbox. So instead of getting rid of the "forgot password" email, get rid of the password itself.

The forgot password e-mail could do the following:

blablabla.
Click here to set a new password
Click here to log me in

Clicking the second link could redirect you to the site, reset your password and set your session to "logged in", skipping the step of entering a password twice that you will tell me is insufficient anyway and I will forget within minutes.

There's a lot to do to make it work well, but nothing out of the ordinary:

• the link sent should expire (no old links letting you log in)
• measures to prevent spamming vs. impatient users not getting their link fast enough (you need to allow multiple pending "log me in" links)
• consider how long this login should last - session? A day? A week?
• An explicit logout should also invalidate the link

The heightened risk is a more frequent e-mail communication (without cookies, every time you log in) which could be captured. Plus user is more dependent on a 3rd party utility - email - for access to your site. That's icnremental, not completely new, however.

LogMeIn.html

Let the user download a permanent "log me in" file. (e.g. a plain HTML file containing a form with a "log me in to forthrin.com" button, submitting the login ID over https://).

Access to the site would now require access to the user desktop where this file is stored, something that most users would at least be comfortable with - or, to put it more bleakly: for most users, access to their desktop means access to their e-mail and/or totallynotmypasswords.txt, which means access to most sites.

A more "physical" token like this might be more convenient in user perception, though.

Answer 4

Some thoughts conserning your scenarios.
A) If the user logs in with the incorrect password, send him the password
User could enter correct password from second or third try, iterating through his passwords or correcting keyboard layout or caps lock or just correcting typo. So wrong password is not always the sign of need to restore it. More smart behavior is to propose to reset password after several wrong tries.

B) If the user logs in with no password, send him the password
Having an empty field probably majority of users don't guess to submit the form as it is known the password is mandatory. So if several password guessing tries fail, users will search how to restore the password. They will check FAQ, About Us searching for contacts etc.

Just one link "Forgot password" solves this issues. Besides it is familiar way to restore password.

Answer 5

In my mind, much of what we do for security, including passwords, is as much for the mental security of the user as it is for actual security. Whether a system is secure or not, if it makes the user feel secure and gives them peace of mind that can be a good benefit as well.

I like the direction you're thinking on this, but I wonder if it crosses from "helpful" to "creepy" a little bit. "Forgot password" might not be the best, but that familiarity does give a sense of security to most users. That doesn't mean that something like this couldn't be tried, but I'd recommend strong usability studies to make sure that users don't find it creepy. There's a fine line between "creepy" and "helpful."