2

User 1 is an account administrator and can create (invite) other users on the account. User 1 inputs an email address for User 2. User 2 receives a welcome email at that address with a link to confirm. Clicking that link, User 2 is taken to the site to create a password and log in.

Security is extremely important here, so there's major concern around what should happen if User 1 put in the wrong email address for User 2 and devious User 3 gets the email instead. User 3 would be able to create an account and wreak havoc.

One solution I'm considering is that the user who receives the welcome email will need to verify some other bit of information that we've also collected from User 1 on their behalf (e.g. User 2 will need to supply first & last name or phone number after clicking the link in the welcome email). I like that approach but I'm nervous the data may not match exactly and legitimate User 2 will hit unnecessary friction. For example, what if User 1 misspelled their name or put in a company phone number instead of their direct line? As far as I'm aware, User 1 and 2 will have some existing relationship so User 1 should be able to communicate any special sign up criteria to User 2.

This does seem a little edge-casey and reminds me of http://xkcd.com/970/, like we're building a lot of validation around something that will probably be filled out correctly 99% of the time. But we've chosen to use account admins instead of letting each user sign up individually because there are hundreds of accounts in the system and new users need to be associated with at least one account to do anything.

Does anyone know another service where you need to be invited and validate some information before you're allowed entry?

Improve this question

4 Answers 4

Reset to default
3

I like the way Apple do it with their "iTunes Connect" system for managing apps. They have a 2 step process

Step 1

They have a "Users and Roles" section which offers the admin (User 1) to send invitations to email address's and also provide "Roles".

Notice that they make it very easy to see when people have accepted the invite, allow you to resent it and also delete the user if they do not accept the invite. But the best part is that even if someone accepts an invite, they are not immediately able to do anything with this new power.

This means that you could keep:

  • Keep an eye on the status of your invites
  • Revoke invites if mistakes are made
  • If someone accepts, they do not immediately have any new abilities which is good for your security point
  • Assign roles which allow access limited access until your security checks are made from step 2

enter image description here

Step 2

Only after those users are activated can they be accepted to do whatever it is you want them to do. In your case that could be to send them out an email link to provide you with the information you need. Which when done could give them a new role with limited powers until you are happy to upgrade them?

Improve this answer
2

Use your scheme with invitations and links but do put the new users in a walled-garden like environment. They are associated to their corresponding admin, they may sign in and use basic functions (like sending the admin a message or related functions) but the admin has to verify the logged in user, this will be a one-more-click process for the admin, but a frictionless signup for the user.

Additionally the admin gives consent by clicking that he is certain to add this user, any wrong decisions will be totally his fault, not the fault of a typo. The misreading of an E-Mail address seems to be even more unlikely then the misspelling to me.

Improve this answer
1

Utilize two channels of communication and both channels should carry a part of information to complete the process. In your case,

  • Generate a paired (signup) link and password. Both should be used with each other and once only.
  • Send your intended user his signup link via email and password using SMS.
  • When the user begins his signup process, ask to provide password he received over his phone.

This will ensure that if email was sent to a wrong user, he is not able to get through.

Improve this answer
1
  • Thanks Salman. I like the two-channel approach, but unfortunately we can't rely on the phone number to be SMS-enabled. Does that spark any new ideas?
    – iamsuthy
    Commented Mar 9, 2016 at 15:50
0

User1 can type in Users2, name i.e., but User2 while doing the validation step can have options; My name is randomname, randomname, typedinname.. This way you can avoid spelling errors.
Options can be in openned bubbles i.e., this was filling out 3 - 4 questions like this will be really fast and within 5 seconds.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.