I am redesigning a social network which uses login via Facebook or an email signup/login. In the case of email signup/login users needs to just give their email address and we will send a confirmation link. Once the link is clicked, we take it as confirmation of the user identity and they can continue.
This session is stored in browser cookies and hence the user doesn't need to sign in again the next time. There is an optional password setting flow, but we are not making that obvious. In the event the user tries to login again from another machine (or after clearing cache), we again ask them to input an email, and the same email acts as either a new user signup or as an access token to an already signed up user.
We are not too happy with the workflow now for few reasons.
- The new email design from Gmail, often pushes our access link emails out of a new users' primary mailbox.
- In mobiles especially this going back and checking the email is becoming a cumbersome activity
- Users are not really getting the workflow as they usually expect an immediate password field or an access to the app. We are giving the message to check the emails, but for some reason, there is drop off at this stage.
We are thinking of introducing the password box now, but reverting back to the tried and tested email/password collection upfront leaves a lot of questions unanswered. We don't know the legitimacy of the users. This will force us to check the email credentials again with another workflow, which we want to avoid.