3

There is a fantastic article entitled Is it time for password-less login? that suggests that we could use the "reset password" link as the default login action to any site. It provides a lot of benefits, such as not having to remember any arcane passwords and potentially increasing the security of the site, so in general I like the idea.

I can think of one issue, the unfamiliarity of the interface, but what other obstacles could a password-less login system pose to users?

  • Given the number of times people forget their password, I would not consider the interaction pattern at all unfamiliar. – Evil Closet Monkey Jun 6 '14 at 20:17
  • That's a good point. The interaction isn't unfamiliar, but the context of that interaction maybe. Still, it's significantly more familiar than something like a 2-factor auth or even maybe a "login with facebook" feature. – Dan Gayle Jun 6 '14 at 23:54
  • 3
    This does not increase security, it decreases it. Email is not encrypted, remember. It is acceptable in some contexts, not in others. – Steve DL Jan 20 '16 at 11:52
  • Or use OpenID - that way you don't need another password, just your ID provider's one (e.g. email). – Danny Varod Apr 28 at 11:33
8

The potential issue that comes immediately to mind is delay.

Yes, as Evil Closet Monkey says in the comment here, and many others have said across many questions, forgetting a password is very common, and thus people are familiar with password reset functionality.

But if I have to do that every time I login, I have to wait for the email to arrive before I can sign in to the site, and email can get delayed. I am being punished if I do remember my password, or my browser does, or if I use a password manager, and that is a poor user experience.

  • One thing I like about this is that there is no password to remember (or store in the DB). – Dan Gayle Jun 6 '14 at 23:55
  • 1
    It really depends how you normally access the site and what for. For instance I am currently using a website where I only ever need to go to the site in reaction to an email I've gotten from them, which conveniently already contains a login link. – Steve DL Jan 20 '16 at 11:52
2

I'd say it depends on your application. If you can assume that the user isn't coming to your site often enough to remember their password, this is probably a good idea. So for a website that manages my life insurance, I might log in once a year to check to make sure it's still working. I'm going to forget that password anyway, so doing a secure link to login seems great.

On the other hand, if you wanted me to use this login strategy for my email, (assume a different email than you send the link to), I'd probably go on a rampage after a day or so.

  • I have to reset the password on my 401k account every time I use it, because they enforce a weird username system + extreme password combo. – Dan Gayle Jun 6 '14 at 23:51
1

There is an update to the blog post now with suggestions.

Friction problems

I use a hotmail account for all my random logins that I don't log into very often - so I would have to switch to another tab, login to my email, wait for the email - it can be 10-30s, switch tabs back to login to their website.

Users with password managers, who can normally login with one click would have to go through the same route of logging into their email and getting the link. One suggestion in the post update was:

simply reverse the order of the password reset tool and the password field on the form.

So then password manager users aren't impacted and other users can see the reset link a bit easier.

Initial sign up

One very good use case for this which is the initial login which is critical for many sites.

To sign up, you only enter your email and get logged in directly. Similar to signing up for a newsletter. Then a password reset email is sent to you. You might start with slightly restricted permissions but it does give you a chance to see if you like the site.

Also you can do it that you sign up with email and password and are directly logged in, which avoids the step of having to reset your password separately. Then you just have to confirm your email address. Buffer do this quite nicely.

Reset = Log in via email

Assuming that people will reset their password is a good thing. So putting time into improving that process is worthwhile.

  1. We could stop calling it 'reset password' and just call it 'email login' / 'login via email' - then your password stays the same.
  2. Also using mail apps like Mandrill that should speed up the process of sending the email
  3. Making the password reset email as clear as possible.

Alternatives

The obvious is Oauth, but I think putting more reliance on Facebook and Google to handle our logins is bad for the web. Certainly where privacy is concerned as then Facebook and Google know all the sites that you have accounts for. I certainly regard caring about user privacy as UX.

One of the mentions in the blog update is Mozilla's Personas - which they gave up on. There's acutally a very good open letter arguing that Mozilla can help the web better by bringing back Personas instead of pushing Firefox OS, with this rather nice quote:

Put all your eggs in one basket and stick the basket in Fort Knox.

Personally, I think getting users to use password managers is the best way. LastPass is the main one, there's also more recenctly 1Password and I personally use Keepass + KeepassHTTP browser plugin.

1

Users who activate the login link from a mobile mail app may find themselves trapped within a webview. It poses a design challenge to figure out how to allow users to break out into their proper browser, while remaining logged in.

If password-less login is the only option you offer users, you may have to figure out a solution to this.

I have posed this as a challenge looking for answers here: Password-less log in with webviews.

-1

It's interesting thinking - but users forgetting which email address they used is a big part of the login problem in the first place. As a user of password managers, I agree I would feel penalised with the reset every time approach.

The other issue is that emails get lost/spammed filtered and low-tech users have enough trouble with email as it is - including logging into that half the time as well!

Also - email is on the way out for non-business users - millennials at least!

Logging in with Facebook for everything is probably the easiest and most universal strategy LOL!

  • Or OpenID in general, forcing everyone to use a specific external service is a bad practice. – Danny Varod Apr 28 at 11:34

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.