5 ms·

Many solid advices here, but I still have doubts about the real-life UX of switching to emailed links instead of using passwords. It's quite popular for some ti

Many solid advices here, but I still have doubts about the real-life UX of switching to emailed links instead of using passwords. It's quite popular for some time now, and security wise it makes a lot of sense, but: For one, that means that each time I wish to login (or switch between accounts) I need to fill my email and then go to another tab or to mail app, and wait for the email. It's not that uncommon to take a while for an email to be delivered. Requirement to stare for 3-5 (or more?) minutes into a screen of my mail client and obsessively click on refresh button is less than ideal, and would just get more and more annoying the longer one uses the app. And even if email arrives immediately, it's still more steps and time then having my password manager auto-fill the form and log me in. Also a (minor) annoyance with this is that clicking on the link in email will open a new tab/window in the default browser, not reuse the one where I started the login process. And then you have a full bag of all the usual problems with users not getting emails for various reasons, from being marked as spam, to simply moved to Updates tab in gmail, where you can bet that half of your ordinary users will not be able to find them. That will generate your support team some steady flow of extra work, you can bet on that. From my personal experience, each time in some app we were forcing users to confirm their email address upon registration (non-tech founders often insist on this for some reason) we'd see between 40% to even 70% drop. People would register and then never come back because they just didn't care enough to look for our confirmation email. You can try to manually follow up with email in a few days, to offer assistance, but most of them will never reply. By using this approach, you're forcing users into switching their mental context and attention between your app and all the other emails arriving to their inbox, all the notifications on social media, all the other distractions around us. And you can bet that they care much more about any of that than about trying out your app.

ams6110 9y ago
The problem for me at least for mobile access is that I do not have my "real" email tied to my phone. I have an Android phone, but have a separate gmail address that is only used in relation to the phone (activation, google play account, etc.) If I have to read an email in order to sign in to a web app or website on my phone, that means I need to get on my computer and go to fastmail.fm. Which is inconvenient.
- wmf 9y ago
  Is there a reason you don't have the Fastmail app installed?
  - ams6110 9y ago
    I don't consider android phones to be trustworthy, and iPhones are too expensive. So I don't do email, banking, or anything sensitive on my phone.
- jlgaddis 9y ago
  Very similar for me. The only emails I get on my iPhone and/or iPad are alerts for $work. For anything else I have to pull up my mail client (I don't use webmail) so it's a huge pain in the ass. I'm hoping this method of "authenticating" quickly dies out.
virgil_disgr4ce 9y ago
Agreed. And furthermore, some corporate email filtering can delay receipt of emails for HOURS, making it literally impossible to login under certain circumstances, which in my own experience is insane and enraging.
jlgaddis 9y ago
If you're requiring an email/login and 40-70% of users never confirm or bother coming back, perhaps your product isn't something they really want. Personally, I hate being forced to go through the process of creating an account only to quickly discover that I'm never going to use application/website/whatever again.
- ivanhoe 9y ago
  I'm talking about the situation where you can't login into the site without first confirming your email. Yeah, I know it sounds crazy, but owners initially insisted on doing it that way on two separate projects I was involved with. So customer has never seen the actual product. They'd register and then instead of immediately going to their email client to confirm it and login, they'd go somewhere else, and never come back to test the product. In many ways this is a similar process to the one with password links, and I think it would have the same effect.
_cereal 9y ago
> each time in some app we were forcing users to confirm their email address upon registration (non-tech founders often insist on this for some reason) we'd see between 40% to even 70% drop. People would register and then never come back because they just didn't care enough to look for our confirmation email. Some countries in Europe require to prove user opt-in consent, in addition the EU General Data Protection Regulation (GDPR)[1] approved in 2016 and active starting from May 2018 will, in practice, extend it to all EU countries. [1] https://en.wikipedia.org/wiki/General_Data_Protection_Regulation https://en.wikipedia.org/wiki/General_Data_Protection_Regula...

ams6110 9y ago

The problem for me at least for mobile access is that I do not have my "real" email tied to my phone. I have an Android phone, but have a separate gmail address that is only used in relation to the phone (activation, google play account, etc.) If I have to read an email in order to sign in to a web app or website on my phone, that means I need to get on my computer and go to fastmail.fm. Which is inconvenient.

wmf 9y ago
Is there a reason you don't have the Fastmail app installed?
- ams6110 9y ago
  I don't consider android phones to be trustworthy, and iPhones are too expensive. So I don't do email, banking, or anything sensitive on my phone.
jlgaddis 9y ago
Very similar for me. The only emails I get on my iPhone and/or iPad are alerts for $work. For anything else I have to pull up my mail client (I don't use webmail) so it's a huge pain in the ass. I'm hoping this method of "authenticating" quickly dies out.

virgil_disgr4ce 9y ago

Agreed. And furthermore, some corporate email filtering can delay receipt of emails for HOURS, making it literally impossible to login under certain circumstances, which in my own experience is insane and enraging.

jlgaddis 9y ago

If you're requiring an email/login and 40-70% of users never confirm or bother coming back, perhaps your product isn't something they really want. Personally, I hate being forced to go through the process of creating an account only to quickly discover that I'm never going to use application/website/whatever again.

ivanhoe 9y ago
I'm talking about the situation where you can't login into the site without first confirming your email. Yeah, I know it sounds crazy, but owners initially insisted on doing it that way on two separate projects I was involved with. So customer has never seen the actual product. They'd register and then instead of immediately going to their email client to confirm it and login, they'd go somewhere else, and never come back to test the product. In many ways this is a similar process to the one with password links, and I think it would have the same effect.

_cereal 9y ago

> each time in some app we were forcing users to confirm their email address upon registration (non-tech founders often insist on this for some reason) we'd see between 40% to even 70% drop. People would register and then never come back because they just didn't care enough to look for our confirmation email. Some countries in Europe require to prove user opt-in consent, in addition the EU General Data Protection Regulation (GDPR)[1] approved in 2016 and active starting from May 2018 will, in practice, extend it to all EU countries. [1] https://en.wikipedia.org/wiki/General_Data_Protection_Regulation https://en.wikipedia.org/wiki/General_Data_Protection_Regula...