5 ms·

I think that #3 (Log users in from emails clicks automatically) is the most important here. I hate it when I click a link in an email, then immediately have to

by mfkp 13y ago

I think that #3 (Log users in from emails clicks automatically) is the most important here. I hate it when I click a link in an email, then immediately have to log in. Half the time it's not worth the effort and I close the tab. I would guess that conversion ratios can be improved by a large amount by automatically logging users in via a token in the email link.

cgriswald 13y ago
This is most annoying when they're asking me to write a review or respond to another customer's question. They're already asking me for free labor. They want to add their security to my list of chores. They must invision a bot which intercepts emails for products and writes positive or negative reviews depending on who is paying the bills. The problem is exacerbated by the fact that I'm usually checking those emails on the phone where it is often a PITA to enter passwords.
draker 13y ago
How long would you consider reasonable before requiring the user to enter a password when clicking through an email? Basically, how long should the token be valid from a user perspective? From a developer perspective I think unless you are comfortable with a 1-2 week token* (or longer depending on customer base) you could actually decrease conversion rates because you remove the features consistency. Ex: a user is cleaning out emails, starts with the most recent and works their way back. Opens OkCupid message from 3 weeks ago because it was interesting, but the link doesn't work. *I would appreciate further insight as to what is a normal length of time for tokens to be valid and the impact increasing the token expiration time might have on security.
- ultrafez 13y ago
  In this situation the user would already be logged in from opening newer emails, so opening the older emails would use their existing session, even though the token has expired. Or if the user visits an old email without looking at a new email first, the user can just log in as usual.
prawn 13y ago
I assume a lot of that is protecting the account or identity from people forwarding an email to friends. One that I find a bit annoying is clicking a link to reset a password, then having to login again with that same password. Seems a bit unnecessary.
otterley 13y ago
OKCupid puts login tokens in their links used in their notification emails, so that when you click on them, you're automatically logged in. Convenient, right? But what if a novice user copies the link and sends it to a third party ("hey, take a look at this match!"), not knowing the significance of the extra data in the URL? http://edelsont.livejournal.com/14163.html http://edelsont.livejournal.com/14163.html
- thangalin 13y ago
  Authentication tokens should expire after first use; other sanity checks: 1. Tokens should expire after no more than five minutes. 2. Embed a 1-pixel image in an HTML-based e-mail also contains the token. When the e-mail is first opened, the server associates the IP address from the e-mail with the token. Only subsequent authentication requests for that token/IP address pair pass validation. 3. Log IP addresses used by an account. Additional new IP addresses outside the usual geographical area (GeoIP) should fail validation. This assumes that the first person to click the link is the intended recipient. Any other ideas?
  - pferde 13y ago
    These are all ideas which would cover maybe 80% of use cases, but severely annoy the remaining 20%. Is that a good idea?
    - jessaustin 13y ago
      The fallback can be that you have to log in with a password. Which is bad, but apparently tolerable.
  - mattmanser 13y ago
    2 Won't work any more now that Google have led the charge with downloading images in email messages to their own servers and serving them to users themselves. I expect all email providers to follow Google's lead on that tbh because it's really quite good. 3 is a bit of a problem with residential broadband as IP address get re-assigned a fair bit.

by mfkp 13y ago

cgriswald 13y ago

This is most annoying when they're asking me to write a review or respond to another customer's question. They're already asking me for free labor. They want to add their security to my list of chores. They must invision a bot which intercepts emails for products and writes positive or negative reviews depending on who is paying the bills. The problem is exacerbated by the fact that I'm usually checking those emails on the phone where it is often a PITA to enter passwords.

draker 13y ago

How long would you consider reasonable before requiring the user to enter a password when clicking through an email? Basically, how long should the token be valid from a user perspective? From a developer perspective I think unless you are comfortable with a 1-2 week token* (or longer depending on customer base) you could actually decrease conversion rates because you remove the features consistency. Ex: a user is cleaning out emails, starts with the most recent and works their way back. Opens OkCupid message from 3 weeks ago because it was interesting, but the link doesn't work. *I would appreciate further insight as to what is a normal length of time for tokens to be valid and the impact increasing the token expiration time might have on security.

ultrafez 13y ago
In this situation the user would already be logged in from opening newer emails, so opening the older emails would use their existing session, even though the token has expired. Or if the user visits an old email without looking at a new email first, the user can just log in as usual.

prawn 13y ago

I assume a lot of that is protecting the account or identity from people forwarding an email to friends. One that I find a bit annoying is clicking a link to reset a password, then having to login again with that same password. Seems a bit unnecessary.

otterley 13y ago

OKCupid puts login tokens in their links used in their notification emails, so that when you click on them, you're automatically logged in. Convenient, right? But what if a novice user copies the link and sends it to a third party ("hey, take a look at this match!"), not knowing the significance of the extra data in the URL? http://edelsont.livejournal.com/14163.html http://edelsont.livejournal.com/14163.html

thangalin 13y ago
Authentication tokens should expire after first use; other sanity checks: 1. Tokens should expire after no more than five minutes. 2. Embed a 1-pixel image in an HTML-based e-mail also contains the token. When the e-mail is first opened, the server associates the IP address from the e-mail with the token. Only subsequent authentication requests for that token/IP address pair pass validation. 3. Log IP addresses used by an account. Additional new IP addresses outside the usual geographical area (GeoIP) should fail validation. This assumes that the first person to click the link is the intended recipient. Any other ideas?
- pferde 13y ago
  These are all ideas which would cover maybe 80% of use cases, but severely annoy the remaining 20%. Is that a good idea?
  - jessaustin 13y ago
    The fallback can be that you have to log in with a password. Which is bad, but apparently tolerable.
- mattmanser 13y ago
  2 Won't work any more now that Google have led the charge with downloading images in email messages to their own servers and serving them to users themselves. I expect all email providers to follow Google's lead on that tbh because it's really quite good. 3 is a bit of a problem with residential broadband as IP address get re-assigned a fair bit.