6 ms·

The best and most simple onboarding process I've ever experienced was with expensify. I don't know if it's still like this, but you just enter your email addres

The best and most simple onboarding process I've ever experienced was with expensify. I don't know if it's still like this, but you just enter your email address and you're in... your account is running and you're logged in. Everything else can be figured out later. Bots? Idle new accounts are probably deleted after a number of days. Password? A reset/creation link can be sent to your email the next time you try to login. Payment? That's only important if you're going to use the software -- it can be handled when appropriate. Unless your service has some major expense or limited resource associated with account setup (ex. assigning the user a new phone number), I would love to see more signups like this. The lack of friction made me feel so happy as a customer and I instantly had a positive impression of the service because it already felt like it was adding value by making my life easier. I wouldn't be surprised if this also has a positive impact on their conversion rate.

JoshTriplett 6y ago
That's fine as long as you send a welcome email immediately that says "If you didn't create this account, use this link and you'll never get another email at this address". I've seen services forget that, and then it's possible to sign up with someone else's email address, use the account, and have someone else get spammed or harassed. That needs to be part of your threat model. "What if a bot signs up" is about protecting your service and people using it. "What happens if someone signs up with someone else's information" is about protecting other people, who may have nothing to do with the service.
- jlokier 6y ago
  > "If you didn't create this account, use this link and you'll never get another email at this address" If I get an unsolicited email for a service I don't recognise, that has a link in it and a message asking me to click on it, should I click on it? Commmon advice is don't click on links in mails you aren't expecting. It just confirms your address is real for spam harvesting.
  - Gene_Parmesan 6y ago
    This is what I've heard as well, although I've never actually confirmed it to be true.
  - bcrosby95 6y ago
    I don't know who gives that advice, but it seems poorly thought out. Email providers already tell people sending email when an address is real or not. You clicking the link would tell them you read your email. I'm also not sure what you're afraid of. If your account has been in existence for long enough, you already get a lot of spam. It just gets blocked or filtered. The vast majority of your emails that actually get to your inbox are from people trying to do the right thing, not people trying to screw you over.
    - Hnrobert42 6y ago
      I think they are afraid of a phishing attack that requires a click to land a remote code exploit.
    - sokoloff 6y ago
      > Email providers already tell people sending email when an address is real or not. I don’t think email works the way you seem to think it works.
      - bcrosby95 6y ago
        Email deliverability was part of my job for around 8 years. Providers will absolutely send you a bounce message (via the return path email) if an inbox does not exist. Or even if it is full. The messaging is not standard so you have to do all sorts of special case parsing because each provider can give a different message. And ignoring these messages will hurt your ability to deliver email. So if your plan is to hide your address from people, again, I don't see the point.
        sokoloff 6y ago
        I believe there's value to marketers to know "this email address somewhat reliably hits a human's eyeballs" as evidenced by a click-to-unsubscribe or click-to-refute action as a stronger signal than "well, we didn't get a bounce". "Email providers already tell people sending email when an address is real or not." suggests a level of reliability of signal that simply doesn't exist. I have an infinite number of email addresses that you could send to, which would not give you a bounce, and none of which will reliably land in front of a human's eyeballs.
- bonestamp2 6y ago
  Yes, I completely agree. This should be standard for all account welcome emails.
- RyJones 6y ago
  For a long time, Uber didn't validate email addresses; lots of people set up accounts using my gmail address. I had no recourse.
  - bonestamp2 6y ago
    For eight years, I've been trying to get my email address out of Xfinity's databases. The customer support team literally can't find my email address in their system and I still get emails. They passed my case on to engineering and they can't find it either. Not only have I never been an Xfinity customer, I've never even lived in an area where I could have be an Xfinity customer. Thankfully, the emails are few and far between now.
    - Reason077 6y ago
      Just set up a filter to delete them. I've been doing this for all Facebook emails for years.
      - bonestamp2 6y ago
        Yes, I do have a filter for them. But it's still annoying since it's just shifting the problem -- now I have a growing list of filters to maintain. But I appreciate the suggestion.
    - the_pwner224 6y ago
      > Each separate email in violation of the CAN-SPAM Act is subject to penalties of up to $43,280, so non-compliance can be costly. https://www.ftc.gov/tips-advice/business-center/guidance/can-spam-act-compliance-guide-business https://www.ftc.gov/tips-advice/business-center/guidance/can... From what you said it appears every single one of their emails is a violation. I don't know how much time it will take you to actually pursue that or whether it will be worth the time, but I'm sure lots of people will be very happy if you make Comcast lose a bunch of money.
- johndough 6y ago
  I fully agree. A while ago, I registered a domain name consisting of adjacent keyboard letters and set up a catch all email address (huge mistake). Next, I got roughly 1000 mails per week, of which fifty were promotional offers sent to "my" Verizon accounts. Of course it is impossible to reach any human being at Verizon to get this fixed.
  - ValentineC 6y ago
    What email host are you using? Have you considered blacklisting individual email addresses?
- 101404 6y ago
  That's illegal. You want me to opt-out in order to stop spamming me? Nope. I will never click a link in some spam mail I receive. Even if you claim that your service is "legitimate". If you want to be allowed to email me, you must often a double opt-in. And that is a click to confirm the address.
  - JoshTriplett 6y ago
    That's not what I was suggesting at all. If your service actually sends people emails (other than, say, password resets), then you still need them to follow a "verify your email" link before sending them mails other than the single "welcome" message containing that link. I'm just saying that you don't need to wait for email verification before letting people make and use an account, as long as you don't send them any more emails beyond the welcome message. Many services don't send regular emails, and only ask for an email so that 1) everyone has a unique identifier without having to make up a unique username, and 2) they can do password resets. For such services, the procedure above makes sense to reduce friction.
    - abiogenesis 6y ago
      I still wouldn't want someone else to be able to register for some service using my email. What happens if I want to use the same service in the future? That happens to me all the time as I have a very generic email address (one of the first users of Gmail). Someone seems to have registered to Facebook with my email and now I can't disassociate it. People searching me by my email address on Facebook end up with that random guy.
      - cortesoft 6y ago
        Shouldn't you be able to request a password reset, which would send an email to you and then you would delete it?
        abiogenesis 6y ago
        Already tried that. It asks me that other person's private information (such as date of birth).
- pottertheotter 6y ago
  Far too many websites don't do this. A lot of people seem to think that my Gmail address is their's, so I end up signed up for a lot of email lists. I'm sure Apple is good about this now, but many years ago someone had used my Gmail address for their Apple ID. I wanted to switch my Apple account to use my Gmail, but couldn't because someone else's account used it. Support told me they couldn't do anything about it. I don't know why it didn't occur to me to do this first, but I just reset their password, changed the email address to something else, and reclaimed my email.
  - bbx 6y ago
    > I just reset their password, changed the email address to something else, and reclaimed my email. I understand it’s the other user’s fault for using your email address in the first place, but I wonder if you could have contacted them to warn them about the change (since they would lose access to their Apple account instantly, with no recovery option). I’m not blaming you. I’m just wondering how it would be done, if needed. I assume that user, when signing up with your email, either a) made a mistake b) was being unhelpful c) or didn’t understand he whole email/ID concept.
    - emilecantin 6y ago
      I've been on the receiving end of a similar thing (but with a gaming website), and there's a flaw with your logic: How would you contact them? The email address they used is yours, it's not like you can just send them an email, you don't have their address.
  - SenHeng 6y ago
    Apple's obviously not going to revert the previous AppleID to your email but I would bet that address is on some kind of 'might be sketchy' list now.
- encoderer 6y ago
  (in case anybody needs to hear it, this is not a launch requirement)
  - JoshTriplett 6y ago
    It only takes one high-profile spamming incident to kill your reputation. This isn't hard to implement.
WillDaSilva 6y ago
I had a similarly fantastic experience with Mullvad. I just clicked the big "Generate Account" button, and that was that. No email, no password, no sign up page whatsoever.
amaccuish 6y ago
Works great for those who are used to it, but I know lots of people get confused. They don't think "Reset password" applies to them. Why should they reset their password when they next login if they never made one in the first place etc...

JoshTriplett 6y ago

That's fine as long as you send a welcome email immediately that says "If you didn't create this account, use this link and you'll never get another email at this address". I've seen services forget that, and then it's possible to sign up with someone else's email address, use the account, and have someone else get spammed or harassed. That needs to be part of your threat model. "What if a bot signs up" is about protecting your service and people using it. "What happens if someone signs up with someone else's information" is about protecting other people, who may have nothing to do with the service.

jlokier 6y ago
> "If you didn't create this account, use this link and you'll never get another email at this address" If I get an unsolicited email for a service I don't recognise, that has a link in it and a message asking me to click on it, should I click on it? Commmon advice is don't click on links in mails you aren't expecting. It just confirms your address is real for spam harvesting.
- Gene_Parmesan 6y ago
  This is what I've heard as well, although I've never actually confirmed it to be true.
- bcrosby95 6y ago
  I don't know who gives that advice, but it seems poorly thought out. Email providers already tell people sending email when an address is real or not. You clicking the link would tell them you read your email. I'm also not sure what you're afraid of. If your account has been in existence for long enough, you already get a lot of spam. It just gets blocked or filtered. The vast majority of your emails that actually get to your inbox are from people trying to do the right thing, not people trying to screw you over.
  - Hnrobert42 6y ago
    I think they are afraid of a phishing attack that requires a click to land a remote code exploit.
  - sokoloff 6y ago
    > Email providers already tell people sending email when an address is real or not. I don’t think email works the way you seem to think it works.
    - bcrosby95 6y ago
      Email deliverability was part of my job for around 8 years. Providers will absolutely send you a bounce message (via the return path email) if an inbox does not exist. Or even if it is full. The messaging is not standard so you have to do all sorts of special case parsing because each provider can give a different message. And ignoring these messages will hurt your ability to deliver email. So if your plan is to hide your address from people, again, I don't see the point.
      - sokoloff 6y ago
        I believe there's value to marketers to know "this email address somewhat reliably hits a human's eyeballs" as evidenced by a click-to-unsubscribe or click-to-refute action as a stronger signal than "well, we didn't get a bounce". "Email providers already tell people sending email when an address is real or not." suggests a level of reliability of signal that simply doesn't exist. I have an infinite number of email addresses that you could send to, which would not give you a bounce, and none of which will reliably land in front of a human's eyeballs.
bonestamp2 6y ago
Yes, I completely agree. This should be standard for all account welcome emails.
RyJones 6y ago
For a long time, Uber didn't validate email addresses; lots of people set up accounts using my gmail address. I had no recourse.
- bonestamp2 6y ago
  For eight years, I've been trying to get my email address out of Xfinity's databases. The customer support team literally can't find my email address in their system and I still get emails. They passed my case on to engineering and they can't find it either. Not only have I never been an Xfinity customer, I've never even lived in an area where I could have be an Xfinity customer. Thankfully, the emails are few and far between now.
  - Reason077 6y ago
    Just set up a filter to delete them. I've been doing this for all Facebook emails for years.
    - bonestamp2 6y ago
      Yes, I do have a filter for them. But it's still annoying since it's just shifting the problem -- now I have a growing list of filters to maintain. But I appreciate the suggestion.
  - the_pwner224 6y ago
    > Each separate email in violation of the CAN-SPAM Act is subject to penalties of up to $43,280, so non-compliance can be costly. https://www.ftc.gov/tips-advice/business-center/guidance/can-spam-act-compliance-guide-business https://www.ftc.gov/tips-advice/business-center/guidance/can... From what you said it appears every single one of their emails is a violation. I don't know how much time it will take you to actually pursue that or whether it will be worth the time, but I'm sure lots of people will be very happy if you make Comcast lose a bunch of money.
johndough 6y ago
I fully agree. A while ago, I registered a domain name consisting of adjacent keyboard letters and set up a catch all email address (huge mistake). Next, I got roughly 1000 mails per week, of which fifty were promotional offers sent to "my" Verizon accounts. Of course it is impossible to reach any human being at Verizon to get this fixed.
- ValentineC 6y ago
  What email host are you using? Have you considered blacklisting individual email addresses?
101404 6y ago
That's illegal. You want me to opt-out in order to stop spamming me? Nope. I will never click a link in some spam mail I receive. Even if you claim that your service is "legitimate". If you want to be allowed to email me, you must often a double opt-in. And that is a click to confirm the address.
- JoshTriplett 6y ago
  That's not what I was suggesting at all. If your service actually sends people emails (other than, say, password resets), then you still need them to follow a "verify your email" link before sending them mails other than the single "welcome" message containing that link. I'm just saying that you don't need to wait for email verification before letting people make and use an account, as long as you don't send them any more emails beyond the welcome message. Many services don't send regular emails, and only ask for an email so that 1) everyone has a unique identifier without having to make up a unique username, and 2) they can do password resets. For such services, the procedure above makes sense to reduce friction.
  - abiogenesis 6y ago
    I still wouldn't want someone else to be able to register for some service using my email. What happens if I want to use the same service in the future? That happens to me all the time as I have a very generic email address (one of the first users of Gmail). Someone seems to have registered to Facebook with my email and now I can't disassociate it. People searching me by my email address on Facebook end up with that random guy.
    - cortesoft 6y ago
      Shouldn't you be able to request a password reset, which would send an email to you and then you would delete it?
      - abiogenesis 6y ago
        Already tried that. It asks me that other person's private information (such as date of birth).
pottertheotter 6y ago
Far too many websites don't do this. A lot of people seem to think that my Gmail address is their's, so I end up signed up for a lot of email lists. I'm sure Apple is good about this now, but many years ago someone had used my Gmail address for their Apple ID. I wanted to switch my Apple account to use my Gmail, but couldn't because someone else's account used it. Support told me they couldn't do anything about it. I don't know why it didn't occur to me to do this first, but I just reset their password, changed the email address to something else, and reclaimed my email.
- bbx 6y ago
  > I just reset their password, changed the email address to something else, and reclaimed my email. I understand it’s the other user’s fault for using your email address in the first place, but I wonder if you could have contacted them to warn them about the change (since they would lose access to their Apple account instantly, with no recovery option). I’m not blaming you. I’m just wondering how it would be done, if needed. I assume that user, when signing up with your email, either a) made a mistake b) was being unhelpful c) or didn’t understand he whole email/ID concept.
  - emilecantin 6y ago
    I've been on the receiving end of a similar thing (but with a gaming website), and there's a flaw with your logic: How would you contact them? The email address they used is yours, it's not like you can just send them an email, you don't have their address.
- SenHeng 6y ago
  Apple's obviously not going to revert the previous AppleID to your email but I would bet that address is on some kind of 'might be sketchy' list now.
encoderer 6y ago
(in case anybody needs to hear it, this is not a launch requirement)
- JoshTriplett 6y ago
  It only takes one high-profile spamming incident to kill your reputation. This isn't hard to implement.

WillDaSilva 6y ago

I had a similarly fantastic experience with Mullvad. I just clicked the big "Generate Account" button, and that was that. No email, no password, no sign up page whatsoever.

amaccuish 6y ago

Works great for those who are used to it, but I know lots of people get confused. They don't think "Reset password" applies to them. Why should they reset their password when they next login if they never made one in the first place etc...