1

It seems as though all the major sites that use an email as a login only allow for forgotten passwords. Looking to find how users can recover an account when they have forgotten their login email.

At the moment I have a link to a page that allows 5 attempts and after the 5th failed attempt they can make contact with a person for verification. Is there a security issue with this?

Improve this question
4
  • Just keep in mind an email isn't normally forgotten because it is used almost always. I'm kind of curious, do you have data that supports this, and if you do, could you share?
    – UXerUIer
    Aug 30, 2015 at 4:18
  • 2
    @Majo0od In addition to forgetting passwords, people do forget email addresses or other forms of user ID, especially if they purposely created one for a specific site that they infrequently visit. Another forgetting scenario is when a browser auto-fills the email or user ID and then, unexpectedly, one day it doesn't auto-fill, leaving the user to fill in the gap. And another forgetting scenario is when they create a user ID for a site or service that they only intend to visit once, and then—much later—find they must return.
    – JeromeR
    Aug 30, 2015 at 10:58
  • 1
    @JeromeR the scenario you mention is exactly how this service will be used. Infrequent use but the user account is of a high importance where they can't just create a new account if they haven't been there in over a year. My thinking behind the 5 attempts for recovery is that it would catch the large bulk of people as although we can forget which email we signed up with, not many people would have over 5 potential emails they could've used to sign up.
    – cheebo
    Aug 31, 2015 at 0:03
  • That's a good approach!
    – UXerUIer
    Sep 4, 2015 at 12:37

4 Answers 4

Reset to default
0

You can break up the entry of the username/email address and password into two phases with an appropriate prompt depending on whether the user has already successfully entered their username/email address or not.

For instance, on CapitalOne's website there is a "Forgot ID or Customer #?" link before the form entry initially, followed by a "Forgot Password?" link once you've successfully entered your ID. On gmail.com, there is a "Need Help?" link before you successfully enter your username/email address that becomes "Forgot Password?" once you've entered it.

For security purposes, I would block too many failed login attempts (even invalid email attempts) as it sounds like you are, but allow a user to click some sort of "Need Help?" link for support logging in at any time, not just after 5 failed attempts. (Gmail, for instance, uses a recovery email or phone number set at registration to support forgotten usernames/email addresses.)

Improve this answer
1
  • Thanks for the feedback, I agree that giving the user choice is the way to go and collecting a phone number at the initial signup is not intrusive.
    – cheebo
    Sep 5, 2015 at 22:25
0

I think I saw this behavior once.
It said,
enter image description here

Although it is one of those horrid personal acts of valor, I realize that I must accept some of the burden of responsibility that joining a website carries. Helping someone achieve maturity, aka "Tough Love" is an ennobling characteristic. Be proud.

Improve this answer
0

Validate the email address before form data has been submitted (if you are not already doing so.)

Here's an example from a few years ago of Twitter's approach to email validation during signup (from http://designmodo.com/ux-form-validation)

enter image description here

People may forget which email address they used to sign up, but they also might just have a minor typo that they didn't notice before hitting submit. If they get feedback about that error immediately, they're less likely to fail repeatedly and need additional assistance.

A similar approach can be used on login forms to confirm whether an email address is valid before submission.

Improve this answer
1
  • That's a user-enumeration vulnerability...
    – Neil McGuigan
    Sep 15, 2015 at 23:14
0

It needs to be both, secure as well as quick.

If say, the Email ID/ Username you're entering isn't registered on the website, it needs to show a meaningful prompt that the ID is unregistered and you might have forgotten it. From there, it will need to have a button to redirect you to the verified email ID, where you'll find another email to proceed with the steps.

How this works?

  1. You specify a Verified Email so that if you forget your email, instead of revealing your email to you, an email for revealing your ID will be sent on the verified email.

  2. This is secure since the verified email is provided by you and is assumed will be accessed by you.

  3. To make it more secure, there could be a two factor authentication to also send a code on your device which you could enter and gain the login email instantly.

Two approaches I believe are secure enough.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.