2

I work on a web app that requires users to complete a form for registration including their email address. The form has to be approved by a human before an account is created. The email address is then used as their username. The admin users creating the accounts are running into issues of mistyped email addresses, resulting in an inability to create an account for the end user.

I've suggested a double entry email to confirm (ick) as well as an extra step of immediate confirmation email for verification. Neither idea is great. Looking for other ideas.

Improve this question
1
  • When you say "username", you mean use it for authentication purposes, yes? I wouldn't want to see the user's email address publicly visible for anyone who wants to take it.
    – cimmanon
    Oct 18, 2013 at 18:23

3 Answers 3

Reset to default
3

Never tried this before, but what if you were to show the users their email again in a larger text pop-over once they click submit, and say "please confirm your email is typed correctly" with [yes] or [edit] options. I've found for me seeing what I wrote in a different context makes my errors leap out of the screen. I'll see typos in this comment only after I click "Post Your Answer" because the formatting will change slightly. I'll then read it again to make sure it all submitted correctly (and quickly hit edit to fix the inevitable). Perhaps a similar construct will work for forms?

Improve this answer
3

Using an email address as a username is probably not the best idea: they are not constant. An email address is just that: an address. People move house and change their home address; they can change their email address far more easily!

Better to let the user choose a username (perhaps you could suggest valid available usernames from their real name?) and enter their password (twice if it's masked) and email address (once).

Tell the user to expect an email, and send an email to that address to validate it — that is, the user has to acknowledge it. It would be this validation which would trigger the human intervention to authorise the account. If necessary, the email address could be locked between validation and authorisation to stop the user changing a valid address to an invalid one.

If the email doesn't arrive, the user can log in to change their email address. Prior to the manual authorisation, this would be the only thing they could do with their account.

It would still be possible for the human authoriser to deny access to the system and remove the account to make the username available for someone else.

Improve this answer
4
  • 3
    Users are more likely to forget their username than their email address. Usernames (for authentication purposes) don't have to be immutable, just unique.
    – cimmanon
    Oct 18, 2013 at 18:30
  • @cimmanon more likely, maybe... But most seasoned surfers will have only one to a few usernames, so its not like we are talking orders of magnitude here to my knowledge.
    – Austin French
    Oct 18, 2013 at 20:54
  • 2
    You would be surprised. Also, in a majority of account registration systems, users are not allowed to even login to their account unless it has been validated. If the email address was incorrect at signup, then the user is locked out of their preferred username.
    – cimmanon
    Oct 18, 2013 at 20:58
  • @cimmanon Re usernames: depends what they're used for. I have difficulty remembering which email address I used for a particular system. At least usernames are (generally) shorter! Re validation: just because most registration systems are broken doesn't mean they all have to be. There should be no reason why a user should be locked out.
    – Andrew Leach
    Oct 19, 2013 at 9:55
1

If using email is your requirement:

Doulbe entry (copy and paste not allowed) is the standard I have seen.

Second choice is ping the email before the account creation is complete. A little heavier server resource but user only has to enter once.

“Pinging” an email address using VB.Net coding

ping to check for real email addresses

Improve this answer
4
  • 1
    Disagree pretty strongly with the "copy paste not allowed". Nothing is more infuriating to me than when my bank website started disallowing copy and paste in the password field. I use a password manager, so instead of copy paste I had to manually enter the whole 20 character random string. A step too far, I think.
    – Jeremy T
    Oct 18, 2013 at 19:42
  • @JeremyTunnell, I agree, I am not particularly found of it either. Just saying that is becoming the standard.
    – James Jenkins
    Oct 19, 2013 at 0:56
  • In this case the double entry is a little pointless if you copy and paste and this would only be at registration and not during sign in.
    – Martin Brown
    Jan 6, 2014 at 16:18
  • @MartinBrown the question/answer is about registration, not sign in.
    – James Jenkins
    Jan 6, 2014 at 16:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.