Are people sick of logins?

Question

If you have a website where users 90% of time only read and view content, but rarely post, like a blog, does it make sense to force a login?

If I force the user to login to view some information, like how Quora.com lets you only view the 1st answer unless you log in, will this turn people away? Especially if other sites offering content close to yours don't force logins?

The advantages of a forced login are 2:

• you know exactly who your user is and you can design your website according to user's behavior and
• you can keep scrapers away much easier, especially if you hide the content scrapers want.

Generally, are people sick of logins?

Answer 1

Answering your question, which doesn't involve specific motivation behind it. Yes, people don't like to register on sites, people don't like giving information all the time, people don't like remembering passwords and user names.

This behaviour is common to everyone, but some groups are more annoyed than others and some are more radical than others; for instance, a person that doesn't have much interaction on Internet except to look for some minor things like reading news, visiting one or two social sites and not much more, won't mind registering in one more site if he has a reason to. On the other side of the spectrum, a persona that is browsing a lot, and is already registered in many sites through the years, is more likely to leave a site and not use it again if he has to register and there is no good reason to it.

The most important thing here, is the reason. usually people won't mind registering and then login if you give a good reason for it.

Leaving comments on a blog, for instance, is something that doesn't deserve an account, creating an account on Amazon to buy things, is worth the effort.

Remember, the information or control that you want to have over the user is something that you want, not the user, from the user perspective, it's your job to keep the site clean and functional. Whatever you do behind your site doors, is your problem.

Answer 2

Hiding information behind logins is really bad from the usability standpoint. Imagine you are a user who googles for a certain piece of information.

Workflow on website without registration-wall:

1. enter search-term into search-engine
2. click on first result
3. read question to confirm it's really relevant
4. read answer

Workflow with registration-wall

1. enter search-term into search-engine
2. click on first result
3. read question to confirm it's really relevant
4. click on "register"
5. enter username
6. enter email address
7. open password manager, generate new password, create new entry in password manager, put it in an appropriate folder enter that default password you use everywhere
8. enter password again
9. enter another username because it's already taken
10. solve a captcha (several times because it's unreadable)
11. click confirm
12. open email client
13. wait for confirmation email to arrive
14. click on confirmation email
15. find and click on link in confirmation email
16. navigate to the website you were on
17. read answer

How likely is it that a user will give up, navigate back to the search-engine and just pick another result which doesn't force them to jump through all these hoops?

To be fair, some of these steps could be made more convenient for the user, like not requiring a confirmation through email, using email as username or only using a very weak captcha. But when users see a "register" button, they usually assume the worst-case which is the above procedure and make their decision whether or not they want to go through with it.

Maybe you have a good reason to force people to register. Maybe your entire business model doesn't work without forcing users to make accounts. But keep in mind that by forcing user to register to even see what value your website provides, you are driving a large fraction of them away. Now regarding the two advantages you mentioned:

a) you know exactly who your user is and you can design your website according to user's behavior

That's true, and it might even be in the best interest of the user. But keep in mind that you can perform anonymous user-tracking without requiring any user action by using cookies or localstorage (but please respect do-not-track headers of browsers). Sure, cookies aren't really persistent, but any internet user should be aware that when they want to use features on a website which require persistence between sessions, they need to register. When they do not want these features, or do not want them persisted, they will definitely appreciate the option to not register.

b) you can keep scrappers away much easier, especially if you hide the content scrappers want.

When a scraper really wants to copy your content, what stops them from just registering an account? You can't hide your content from scrapers without also hiding it from legitimate users. There are no technical ways to prevent illegal copying of web content. Only legal ways.

Answer 3

I disagree with @Alphabeticaa's answer. From personal experience, I hate it when I need to register simply because I wish to view an article or post a simple question. I have a "dump" e-mail address with a free provider especially for these "one-time" registrations but I try to avoid them.

As a concrete example, I often browse the Stack Exchange websites and regularly see an interesting post that I would like to upvote or quickly comment on. However, the fact that I need to sign up for every site separately, enter my e-mail address and password and going through a separate form before I can click the "+1" button, despite my having a Stack Exchange account, is so much of an extra step that I usually refrain from contributing even though I think it may be useful.

Answer 4

Depends of how user-friendly the site is

Not only forced logins irritate, but also passwords complexity policies and, of course, unreadable Captchas.

Password policies sometimes make more harm than use. If an user cares about his security, he often has his own password-making algorithms for different sites and when the password policy prevents him to set the password he wants to set, it confuses and irritates more than helps. Those who are careless about security, will not be treated with restrictions dictated by web site designers. And no policy can prevent to use the same password across many sites

About the captchas.... sometimes when I see this "prove that you are not a robot" accompanied with the unreadable picture I think than I might be a robot....

Answer 5

Logins for trivial purposes aren't just annoying for users, they can be very dangerous. Here's why.

No one practices good password security.

You do. I do. Bruce Schneier does. But the vast majority of internet users do not. They use the same 5 or 6 passwords over and over again because everything else is just too damn complicated for them. Remember that your average internet user barely understands the concept of copying and pasting passwords, let alone generating them randomly from a browser add-on or keychain service that's stored in the cloud or what have you. By the time you get to the end of your instructions for using it you've lost 90% of your audience.

Browsers can remember passwords but this power is a flawed one - they don't always prompt to do so, and they don't always recognize the login page. At best it's a stopgap, not a real solution.

Any site with a password is a good hacking target.

Hackers love to get their hands on password tables, even from unimportant sites. It gives them a list of valid email addresses and passwords that the users are known to have used at least once, which can be used to try attacks against more valuable sites like banks or Paypal. With the power of today's hardware and the sophistication of modern day cracking tools, it doesn't matter much if the password isn't stored in the clear - hashing and salting don't help as much as they used to. Easily 50% of passwords, even things like "qeadzcwrsfxv1331", can get cracked in under a day. Anything people are likely able to remember can probably also be cracked. And once that happens, any number of user accounts on more valuable sites like banks or Paypal can be compromised.

You can't blame users for this.

Well, you can, but it won't help. No one's going to side with the owners of a website that was hacked if they try to blame users; at best you will lose your business and at worst you can end up being sued for insufficient security measures.

If it's not worth it for you to offer two-factor authentication for every user, it's probably not worth it for them to use passwords at all. What, if anything, you do for user verification instead depends on the precise nature of user interaction with your site; there are several models including free-for-all, 4chan-style tripcodes, Facebook/Twitter/Google accounts, etc. But if the most valuable thing you store locally is the user password, you don't need logins.

Answer 6

4chan has a very unique user system that may be worth examining:

Anyone can post to 4chan, with absolutely no registration or login required; instead, users must solve a separate captcha for every post. Proof-of-identity for post deletion is handled by having users supply a password (by default, the client generates it for you, so you don't have to enter it), whose hash is stored alongside the post itself. Tripcodes are used to prevent impersonation, as described in their FAQ. When used alongside robust IP bans, their system works marevelously at deflecting most spam (which in this case might not include derp, which is actually the purpose of some boards like s4s). The captcha is only minimally irritating, since users have to wait between postings anyway.

Even their paid features do not require any registration. Users can purchase 4chan passes, which allow users to bypass the captcha when posting. Passes are per IP address, though, not per user, so any user on the same IP can use the pass. Proof-of-identity for changing the IP address associated with a pass works exactly like post deletion.

And throughout this all, there is no registration, login, or user account anywhere.

Users with moderation powers (in the case of 4chan, Admins, Moderators, and Janitors) may in fact have accounts, although exactly how it works is not completely clear from their public documentation.

Answer 7

For example. I was on Stack Overflow, already logged in, and saw this question on the side bar. I wanted to comment and guess what - I have to log in again. Why? What is the point? Now I need to create a Stack Exchange account also?

What PatomaS said is dead on: "The most important thing here, is the reason. usually people won't mind registering and then login if you give a good reason for it."

Sadly, there are so many sites that do not have a good reason for it, or overly complicated, etc etc.

Things like "Sign in with Google" and "Sign in with Facebook" are making this a lot easier... but as a user I would prefer not to have these linked to my Facebook and Google accounts. Getting better, but still not perfect.

Also, it is ironic that the "Sign up using Stack Exchange" feature does not work properly on a User Experience page in IE8. (Can't upgrade - corporate computer. No lectures please.)

Answer 8

Generally speaking, people are coming to your site/app to perform a certain activity. Whether it's buying a present for their friend's birthday, or obtaining a piece of information related to their work. The fewer barriers you put between the User and them achieving that goal, the more successful the site/app you are creating will be in serving the User.

Requiring login because you want to build a mailing list (for example) is putting your needs ahead of the User, and Users will react negatively to that. Instead, provide value. Once you establish trust, you can more effectively request something of the User. You may get fewer registrations, but the ones you do get will be much more valuable.

Answer 9

A quick correction to the top answer by @PatomaS

"creating an account on Amazon to buy things, is worth the effort."

Amazon is an exception in the case of e-commerce.

When selling things a login just gets in the way. All you need is their email address.

The user can access orders using their email and order number and are sent a password if they want to sign in - but are not forced to. The card payment system asks for the information that is needed when it's needed, so again no login needed.

I first came across this method when working for John Lewis and have since worked on ways to avoid the users logging in. For regular users there is a way to login, but it's optional.

My view is that using LinkedIn/Facebook/Open Id/Insertsomethinghere login needlessly ties a site to system.

Logins are great if you're dealing with a bank or an online application where you private content is stored, but you don't have to say who you are in a physical shop, why do it with an online shop? I also am confused why I have to create an account to buy gig tickets. It's not needed and puts a barrier in the way of purchase.

Answer 10

In a world with open ID, users are sick of sites that don't give them the option of using a login they already have but instead insist on them making a new username and password, and putting arbitrary password restrictions on them (e.g. exactly 8 characters, with 1 uppercase letters, 2 lower, 4 digits, and a squiggly).

Answer 11

Logins (and sign ups) sometimes make people feel like they are part of something. A lot of the time, people sign up and log in so that they don't forget about a certain site, and to feel like they a part of the community.

As PatomaS said - there often needs to be a reason to sign up. Special content, features, abilities. It's give and take. As users become more wary in terms of online security and their identity, there needs to be solid reasoning for them to part with their information - and what information, at that.

Answer 12

If the users expect to spend a lot of time on the site, they would not mind creating an account. Otherwise you will lose the prospect, because the effort (typing e-mail, remembering the password) is not worth the benefit.

A good alternative is to use OpenID (like SE does - "Sign up", "Using Google", "Accept", "Confirm"). Just remember not to request any personal information from Google (b/d, gender &c) - people don't like snoops.