6

Imagine this, you are signing-up for a product and you get asked the same old questions when creating an account(Name, email address etc) with the exception of a password.

After you sign-up, an email containing and auto-generated password will be sent to you. You will be able to change the password inside the account section once logged in.

How would you feel about it? What are the negative aspects of it?

  • 1
    Wordpress is investigating a similar route right now: make.wordpress.org/core/2015/05/11/the-plan-for-passwords – giraff Jun 8 '15 at 19:07
  • What exactly is your goal? Increased usability or increased security? – giraff Jun 8 '15 at 19:08
  • Interesting reference the one of Wordpress. Thanks for sharing. My goal is reduce time required to sign-up which eventually translates into increased number of people creating an account in an effortless manner. Research have shown how an approach with now password will have a positive impact on conversion. Users will need to be thinks less about what's required to open an account, they will go straight in to test the product without worrying to much about fields to give at a critical point like the sign-up. – Taritaro Jun 8 '15 at 20:08
  • This is an option for WooCommerce accounts too. I actually decided to switch to removing the password field as WooCommerce now enforces the WordPress password rules which are actually quite strict (you can enter a 20 (fairly random) character + symbol password and it is still rejected as weak). At least the password that you get sent matches the password rules and the customer can login straight away. – icc97 May 12 '16 at 11:36
14

The negative aspect is that you've inadvertently complicated the process.

If I signed up and used my preferred secure password then I'm in and done.

However with the auto gen password approach I have to get the email, click the link, go back to the email, copy the password "G34-zaopwf792hj" (cause I'm not going to attempt to re-type it) paste it in, then hunt down the profile link, then the change password option, then re-paste the old password, then type my actually desired password, save and go back to the actual app.

...and if I'm trying to do this on a phone?... Arghhh!

If you can figure out a way to do this and reduce the number of steps (e.g. Friction) and maintain security I think its worth investigating.

  • 1
    Exactly. And the user has to go through this process instead of working on the task they came to the site to perform. They're spending their time mucking around in email and My Account rather than (for example) buying stuff from your site. – Ken Mohnkern Jun 10 '15 at 19:35
3

Don't do it

There are multiple reasons why:

  1. It worsens rather than improves users communication. Users confronting a signup form without a password field may wonder if their account is secure, wonder why there is no password, etc. By removing the field you are failing to communicate to the user that the account will be accessed via password....in fact you are implying the opposite (i.e. there's no password)

    • To fix this, you could inform the user you will email a password, but that is worse than just showing a password field to begin with.
  2. It creates more UX friction. You may think that removing the password field helps reduce friction for the user to access the site. But think through the scenarios:

    • Scenario 1: User wants to set a password. Since she can't do it at signup, she now has to switch applications to email, click the link, land on a different tab, set the password, then either continue from that new tab or switch back to the old tab. => This is not an improvement over a simple password at signup.
    • Scenario 2: User signs up with email, then accesses the site. You may think this reduces friction, but play it out....sometime later in the day or the next day, the user checks email and sees the password notification. But she's already finished browsing your site! So now she either has to click and set the password even though she isn't using the site anymore, or she ignores the email in which case she will need to go search for it next time she accesses your site. => This is not an improvement over a simple password at signup.
  3. It violates convention. Users are accustomed to signing up to sites by entering a password. By not presenting a password field, you are violating common practice.

    • It's a little like walking a user to a dinner table without chairs. You can explain to the user that a chair will be brought in later when it's time to sit down, but it's better just to behave normally and provide a chair to begin with.
2

I think the key question is, do you need to verify the email address or not?

I would only send an email for verification purposes or just a welcome message.

If you really want to eliminate fields to fill in, you could start with name, emailadress and password. Then ask their other details in a later stage.

1

You could make the process kind of "asynchronous". I mean, let the user sign in and make him/her log in without the need to change the password immediately. In this way you don't "break the cycle".

Regarding security, you could allow only a restricted set of privileges until the user clicks a link sent by email or changes the password.

1

This question could be reworded: Should users be prevented from choosing their own password on initial sign up? Best case scenario, you end up with a streamlined form with a higher conversion rate (people like simple forms) and users that all have strong passwords. This relies on that the users are going to stick with your generated password, which must be both memorable and secure.

This is not as easy as it sounds. Common word passwords are subject to dictionary/rainbow attacks, and if your password algorithm ever gets out then there isn't a whole lot you can do to protect the majority of your users' data. The only ones who would be safe would be those who changed their password manually after signup -- a process you just made more complicated. And if anyone else forgets their password, which is likely given that they did not create it, they'll have to go through yet another password generation process to access their account.

On the other hand, you could just let them pick their own password. You won't be sending anything in plain text, and any frustration the user has with forgetting will be placed on themselves and not your service. You will still be able to make a clean signup form; as the login form by necessity requires a password it won't look any different. My current project has a login form with email and password fields followed by a login and a register button. One screen for all users. Less fuss, less friction.

0

I will have to wait for email. It breaks the flow, go to mail box, check for the mail. Sometimes wait for email. Anxiety!

0

I think this depends on what you're signing up for, and whether the user is likely to return and need a password to log-in.

For example, I once worked on a sign up process which sent the user an automated password in this way because whilst the website needed to collect the user's credentials for later correspondence, the user could, but rarely chose to return to the website.

However, the majority of the time I think asking the user to create a password on the spot would be a better experience - as most users use the same password for everything anyway and are therefore typing this with muscle memory, and very little cognitive effort.

TL;DR: Creating/typing passwords require very little cognitive effort, but any friction should be avoided when possible.

0

That practice is confusing and frustrating for users not familliar with your system. Additionally i could imagine many people not knowing intuitively that they should change their password to their preferred one after logging in and they might forget about that email you sent them and register again out of confusion once they wanted to use your service again.

0

Email would require sending the password in the clear, which is a bad practice (especially if your site stores any personal or financial/payment information).

This is why many websites have stopped offering to email you a forgotten password, now offering to email you a link to reset your password instead. (Another reason for this is that they don't even store your password as plain text, so they can't send it to you anyway).

While receiving your password via email may initially feel like a better user experience in some scenarios, poor site security may mean the positive UX is short lived.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.