3 ms·
I use the following simplified signup procedure: 1) User is asked to enter his email address 2) User is immediately logged in, and a generated password is sent
by jakobe 15y ago
I use the following simplified signup procedure:
1) User is asked to enter his email address
2) User is immediately logged in, and a generated password is sent to his email adress
The generated password is short and pronounceable, lower case only and avoids annoying characters like l, I, 1 etc. While most security experts would consider this password extremely insecure, it is in practice much more secure than any other password the user would choose because the user can't choose the same password he usually chooses. If my server becomes compromised, there's no risk to his other online accounts.
This approach might not be sufficient for a banking site, but it's probably enough to deter occasional mischief.
- bemmu 15y agoAs a user I would like this flow, but as the site owner I worry about people misspelling their e-mail address. They would then proceed to do things under the account, but once their login expires they could never get back.
- icebraining 15y agoShow them the email in nice, big, centered letters after they sign up and let them edit it. I think it was Luke Wroblewski who said this approach reduces misspellings to a ridiculously low number.
- sgdesign 15y agoI really like this. I think that's pretty much my ideal sign-up flow, at least it's the fastest and simplest one I've heard of so far.