11

If you design a barebone registration form which only requires email address and password as essentials can you omit the password repetition and captcha without too much technical trouble?

I personally find password repetition a real pain. Although I understand that it reduces the risk of typos and provides an immediate check, is it not better to take the risk of errors in favour of a simpler process and provide a slick recovery process for wrong passwords instead?

Similar with captchas, a pain for the user, should the business not carry the weight of the troubles which occur without captcha instead of the user?

Improve this question
1
  • I think you actually asked two great questions, so you can see mixed results in the answers section
    – Dvir Adler
    Dec 9, 2012 at 6:21

9 Answers 9

Reset to default
16

NO.

When speaking of either registration forms or comment forms, they are merely common attempts at foiling false registrations, and SPAM. I find Captchas annoying and frustrating.

There are many other options:

Email verification

Multiple choice questions

Random addition (comments on WebDesignerDepot)

Code Via Text Message (Craigslist)

Pictures of Kittens (no, really) Human intervention ("This comment will need to be approved...")

Identifying Sound

Simple Questions

I personally prefer email verification, addition, and simple questions. I believe these can (and in many existing cases, successfully do) replace password repetition and captchas.

Editor's note: Dead shortened URLs removed.

Improve this answer
9
  • 1
    Nice list of great alternatives. Would like to add that I've slowly moved from the common masking of password field. If it's not masked on entry, it never needs to be repeated.
    – Susan R
    Jul 28, 2010 at 19:46
  • While I think plain-text/english/math captchas are better than the scrambled text, there are still issues with those...especially for ESL and LD people.
    – DA01
    Jul 28, 2010 at 20:11
  • Sure, there's truth to that. However, I think the point we can all take from existing alternatives is that the Captcha isn't essential. There are alternatives that can lessen the "pain" for the user, which I think is something we all want.
    – jffgrdnr
    Jul 28, 2010 at 20:28
  • excellent list, thank you! love the kitten idea, which made me think that you can actually combine fun and function with providing pictures which are directly related to the content of the site, nice!
    – bedienbar
    Jul 28, 2010 at 23:04
  • What's ESL and LD?
    – Lisa Daske
    Jul 29, 2010 at 10:43
7

"should the business not carry the weight of the troubles which occur without captcha instead of the user?"

YES! CAPTCHAS are usually a back end problem passed to the user instead.

I think an ideal process for registration:

  • email (no repeat)
  • create username (inline ajax checking to find a unique one)
  • join/sign up

At this point I should be logged in perhaps in a 'unverified' state. I can access/use parts of the site that otherwise wouldn't be damaged by any sort of automated bot accessing.

On the back end, if the email isn't verified after a certain amount of time, kill the account. Otherwise, once a person verifies the email with a reply, they are then promoted to fully registered.

IF there has to be a Captcha, I like a lot of Aevum's suggestions where you revert to a plain-language question.

I've always thought a simple radio list could be useful too:

I am a:
() spambot trying to hack this site
() automated script hellbent on havoc
() just a regular human

The key would be to randomize the phrases sufficiently to avoid bot interpretation but still keep it fairly clear which one a human should choose.

Improve this answer
4
  • 1
    @DA I really, really like the radio list idea you show here. If I'm not mistaken, although bots can select radio buttons and checkboxes, this at least increases the chance for failure... and if possible, would allow the developer to mark the IP of the visitor that selected the "bot" answer, essentially catching spammers in a net... If that's true, that's a solid practice :)
    – jffgrdnr
    Jul 28, 2010 at 20:33
  • 1
    I think it's just as annoying for a user to have to read through all the options and select the correct one than simply copying some captcha text (unless the options bring a smile to the user's face i.e. being funny... but then captchas can be funny too). I prefer the email verification approach suggested above. Also, a lot of sites don't bother with username these days (whenever I sign up to a site asking for a username, I'll usually just type in my email address). Once registered, the site can ask the user if they want to add a 'screen name'.
    – Tej
    Jul 29, 2010 at 8:35
  • The advantage of asking for an email address as a username is that, by definition, your email address is unique to you - nobody else will have registered it first on the site (assuming that it requires verification).
    – PhillipW
    Jul 29, 2010 at 9:56
  • This idea seems awesome! I have seen this done but cant remember where. Do you have any examples as to where this is done? Thanks!!
    – Superchow
    Dec 2, 2010 at 11:37
5

Captchas are the devil's work in my opinion, one evil designed to combat another evil.

One effective alternative is to use a 'honeypot' text field which takes advantage of the fact that most bots fill in all fields in forms. If you have a field which is hidden through CSS and not visible to real users, you know that if that field has been filled then it's a bot submission.

A win win situation for both user and business as the user is not confronted with the pain of filling in a captcha and the business is able to weed out bot submissions.

Improve this answer
4
  • If this is really the way bots work then this is an awesome solution. Can any tekkies confirm that most bots do this?
    – bedienbar
    Jul 29, 2010 at 12:57
  • Some further info on the honeypot technique here haacked.com/archive/2007/09/11/honeypot-captcha.aspx
    – web233
    Jul 29, 2010 at 13:34
  • I'm seeing bots in the wild that are bright enough to figure out hidden field option. I would imagine that this will become more common (since it's obviously something computers can figure out - otherwise your browser couldn't do it :-)
    – adrianh
    Jul 31, 2010 at 18:30
  • I have used this and found it very effective -- it triggered a huge reduction in spam.
    – Michael
    Dec 3, 2010 at 16:01
4

Jakob Nielson suggests to stop password masking: http://www.useit.com/alertbox/passwords.html

Therefore if you agree with him, you can drop the two password boxes, and simply provide one clear-text input box for the password.

I think he is right, provided you give the checkbox option to hide/show characters.

-Asrar

Improve this answer
3

Agree with everybody's opinion of CAPTCHAs. Don't turn your problem into the user's problem :-)

(Also - wait to see if there is actually a problem! The vast majority of the sites I deal with never have problems with bots attempting to register.)

One quick comment on dropping a second password field tho'.

In some user testing I did this caused a little confusion with users since the most common instance of username and single password field in the wild is "log in" not "register".

Clear labelling + adding another (optional) "name" field got around the problem.

Improve this answer
2
  • Good point with the 'login' vs 'register'. But then it made me think, do we really need the distinction between the two. If your basic registration is just made up of username or email and password this will just turn from a 'registration' into a 'first login'. This would change the users perception of the registration AND login concept but I wonder if that would bring any issues...
    – bedienbar
    Jul 31, 2010 at 22:20
  • I think you need to be very clear about distinguishing the two - since from the users perspective they are very different tasks. The call to action is very different.
    – adrianh
    Aug 1, 2010 at 10:43
2

Password repitition leads on to a complicated set of playoffs depending what the site does (which I'm going to go away and think through...).

Captchas obviously just guard the site against automated sign ups.

(No captcha = higher risk of automated sign up)

Again there's a playoff here though: The more 'blurred' the text on the Captcha the more effective it is at keeping both users and automated sign ups out.

Improve this answer
1

how about just enter email field and then confirmation email has password which you can use on first logon and change. You can even send the password as an image to foil spammers.

Improve this answer
0

You should only drop the second password field if you're going to email them their password as confirmation of what it is. But you might want to do this regardless - they might not realise they had caps lock on, or even num-lock on certain laptop keyboards can give unexpeced results.

Unmasking passwords makes shoulder-surfing a lot easier. I'm not greatly fond of that idea, but that also addresses the issue.

Improve this answer
0

Another take at dropping the password repetition and masking, also with a suggested solution: http://uxmovement.com/forms/why-password-masking-can-hurt-your-sign-up-form/

Like the case of entering a WiFi password in windows, I think the checkbox of "Hide my password" is a great balance between security and usability.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.