1

I'm creating an online service that requires users to sign in with their email address, and before they can sign in on a new device, they have to confirm it with an email message in their inbox. The important part of this is that you have to verify the email address for the device you are using before you can check if the password is correct.

I'm considering the requirement of verifying the email before being able to type the password, but this doesn't seem like good UX. If I allow them to type the password, then hit Sign In and require them to send the email, if they typed the wrong password it will show that after they verify the email and they'd have to type it again after they were appeared to have signed in.

What's the best way to accomplish this on the sign in page?

Improve this question
4
  • Is it possible for you to post a flow diagram and/or a use case with a task breakdown? You use "the password" as if it is a known entity, but it is unclear where this comes from. It is just not clear from your question what information the system is gaining by having the user verify that would prevent it from letting them try to login and just get an error message.
    – Nicholas Pappas
    Mar 15, 2014 at 0:09
  • I have two possible solutions: 1) Allow the user to type the password and email at the same screen and if the email is verified then the password is incorrect, bring them back to the last page and ask to retype the password, or 2) require the email address to be put in, then verified, then have the password be typed.
    – Phoenix Logan
    Mar 15, 2014 at 0:28
  • How does the user get "the password"? Is it user defined or system defined? If system defined, how and when do they get it?
    – Nicholas Pappas
    Mar 15, 2014 at 0:38
  • Sorry, I wasn't sure what you meant in your last comment. The password is unique to each user and is set up when the account is created.
    – Phoenix Logan
    Mar 15, 2014 at 0:38

3 Answers 3

Reset to default
0

In my opinion the UX is best when the user does (and the system does) one thing at a time.

The best scenario would be to make the user type in the login and password, and send the mail only if the password is correct. Thus the user has only two actions :

  1. identifying him/herself
  2. and then click on the email link

Once the email is sent, the navigation gets stopped with a message that explains navigation will only be possible once the email is confirmed on the new device.

I don't understand exactly why you want to check the email before the password, but if that's mandatory, then I think you should :

make the user type in the username/email, then send the email "because it's the first time on this device", then redirect the user to type in his/her password.

It becomes three actions for the user, but I think the key to a good UX is precisely to let the user know/understand what's happening, even if it means 3 actions instead of 2.

You can even tell him/her pretty easily at the beginning of the process with a message such as "Before you can log in, please type in your email address so we can secure this device" or something like that.

UX = what the user sees AND understands. If you do invisible stuff, no need for the user to understand. If you do things that have consequences on the user's experience/behavior, make it simple and understandable.

Hope this helps.

Improve this answer
4
  • Even if it does add a third action, it is only necessary when you sign in on a new device for the first time, so it shouldn't be much of a problem. The password won't be on a separate page if the device was already set up anyway, so it's only a one time thing.
    – Phoenix Logan
    Mar 16, 2014 at 3:16
  • That's what I thought. So my second proposition is best :)
    – Alice Rocheman
    Mar 16, 2014 at 3:31
  • Yes, I agree. The reason the server won't accept the password without confirmation is simply because this is a security-first application, and to log in, you have to download a keychain from the server encrypted with the user's password. I don't exactly want anyone to be able to download random people's keychains, even if they are encrypted, just in case.
    – Phoenix Logan
    Mar 16, 2014 at 3:36
  • Thanks for the explanation, I'm a beginner when it comes to security and I was quite intrigued by how your app's security worked! I'll keep this idea in mind for future development ;)
    – Alice Rocheman
    Mar 16, 2014 at 3:41
1

Your description does not indicate any reason why a common screen can't be landed on when the account has not been verified.

enter image description here

This is rather straight forward on the backend and is a very common flow for sites that require e-mail validation.

Improve this answer
2
  • The problem is that the email has to be validated BEFORE the site can check the password. It's actually not a site; it's a native application and it requires the user to download a special "keychain" which is encrypted with the password to sign in. I'd prefer people not randomly downloading people's keychains before verifying their identity.
    – Phoenix Logan
    Mar 14, 2014 at 23:58
  • I've added a comment to the question, in an attempt to understand the issue better.
    – Nicholas Pappas
    Mar 15, 2014 at 0:09
0

You could use the same technique that many online sites do of having an interstitial page after you login, asking that you 'please verify your email and then click here to proceed' (with also a button to resend verification email).

Then, user can confirm that its their device and click on Continue or w/e which will either complain that they have an incorrect password, or just allow access.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.