5 ms·

instead of emailing passwords to the user, send them a link to a confirmation page where they can enter their own password (twice) to complete the registration

by diN0bot 18y ago

instead of emailing passwords to the user, send them a link to a confirmation page where they can enter their own password (twice) to complete the registration process and sign-in. security might be an issue otherwise when sending passwords around in the clear. do the same thing for password resets when a user forgets their password (or username, for that matter).

diN0bot 18y ago
and yeah, the giving up of passwords to other services is a little tricky. i'm not opposed to it, but you have to prove yourself to be completely trustworthy and honorable. i mean, paypal?! also, the 5 number password consisting entirely of numbers that was given to me when i signed on.... so that's 10*5 = 100,000 passwords to check to break into someone's account? it seems a little low. why not a 20-character password consisting of letters, symbols and numbers? the first page i go to when logging in for the first time should be a "change password" page, not a suggested link. or just get the password from the user when they register! :-) otherwise, though, i love the idea. command line SMS for the real world. very cool. no need to remember which phone number to call.
- thomatas 18y ago
  We'll beef it up!
  - DenisM 18y ago
    consider adding an exponential delay for subsequent retries. this way you only punish the guilty (forgetful), not everyone and their brother.
thomatas 18y ago
Good suggestion, we were just trying to follow others suggestions of making the sign-up form as short as possible.
- diN0bot 18y ago
  word. the whole getting users to register is a big problem with lots of paths. you know, you probably don't need email addresses, though. you just need people's phone numbers, right? the whole thing could be sms based, right? nothing wrong with registering online, but one could also make a register with txtful shortcut!
  - thomatas 18y ago
    I like the way you think! Email becomes another way to use your shortcuts though in this case. And we need a way to communicate service or account issues that aren't a priority per se without bugging you on your phone.

by diN0bot 18y ago

diN0bot 18y ago

and yeah, the giving up of passwords to other services is a little tricky. i'm not opposed to it, but you have to prove yourself to be completely trustworthy and honorable. i mean, paypal?! also, the 5 number password consisting entirely of numbers that was given to me when i signed on.... so that's 10*5 = 100,000 passwords to check to break into someone's account? it seems a little low. why not a 20-character password consisting of letters, symbols and numbers? the first page i go to when logging in for the first time should be a "change password" page, not a suggested link. or just get the password from the user when they register! :-) otherwise, though, i love the idea. command line SMS for the real world. very cool. no need to remember which phone number to call.

thomatas 18y ago
We'll beef it up!
- DenisM 18y ago
  consider adding an exponential delay for subsequent retries. this way you only punish the guilty (forgetful), not everyone and their brother.

thomatas 18y ago

Good suggestion, we were just trying to follow others suggestions of making the sign-up form as short as possible.

diN0bot 18y ago
word. the whole getting users to register is a big problem with lots of paths. you know, you probably don't need email addresses, though. you just need people's phone numbers, right? the whole thing could be sms based, right? nothing wrong with registering online, but one could also make a register with txtful shortcut!
- thomatas 18y ago
  I like the way you think! Email becomes another way to use your shortcuts though in this case. And we need a way to communicate service or account issues that aren't a priority per se without bugging you on your phone.