There is an update to the blog post now with suggestions.
I use a hotmail account for all my random logins that I don't log into very often - so I would have to switch to another tab, login to my email, wait for the email - it can be 10-30s, switch tabs back to login to their website.
Users with password managers, who can normally login with one click would have to go through the same route of logging into their email and getting the link. One suggestion in the post update was:
simply reverse the order of the password reset tool and the password field on the form.
So then password manager users aren't impacted and other users can see the reset link a bit easier.
Initial sign up
One very good use case for this which is the initial login which is critical for many sites.
To sign up, you only enter your email and get logged in directly. Similar to signing up for a newsletter. Then a password reset email is sent to you. You might start with slightly restricted permissions but it does give you a chance to see if you like the site.
Also you can do it that you sign up with email and password and are directly logged in, which avoids the step of having to reset your password separately. Then you just have to confirm your email address. Buffer do this quite nicely.
Reset = Log in via email
Assuming that people will reset their password is a good thing. So putting time into improving that process is worthwhile.
- We could stop calling it 'reset password' and just call it 'email login' / 'login via email' - then your password stays the same.
- Also using mail apps like Mandrill that should speed up the process of sending the email
- Making the password reset email as clear as possible.
The obvious is Oauth, but I think putting more reliance on Facebook and Google to handle our logins is bad for the web. Certainly where privacy is concerned as then Facebook and Google know all the sites that you have accounts for. I certainly regard caring about user privacy as UX.
One of the mentions in the blog update is Mozilla's Personas - which they gave up on. There's acutally a very good open letter arguing that Mozilla can help the web better by bringing back Personas instead of pushing Firefox OS, with this rather nice quote:
Put all your eggs in one basket and stick the basket in Fort Knox.
Personally, I think getting users to use password managers is the best way. LastPass is the main one, there's also more recenctly 1Password and I personally use Keepass + KeepassHTTP browser plugin.