Techniques To Simplify Sign-Ups and Log-Ins • Hacker News Board

Re: Techniques To Simplify Sign-Ups and Log-Ins

#111

Post by lukifer » Thu, May 05, 2011, 8:50 PM UTC

bxr wrote: post #76

mekoka wrote: post #73

Another thing that I'll start to experiment with is delayed confirmations. The confirmation step via emails is one of those things that has been copied over and over, without knowing, in many cases, what problem it addresses in the first place and if it's crucial to one's particular situations. I think having to interrupt your visit to log into your email, is another speed bump to a smooth registration process. A bet…

Its also worth it to decide if you need user email addresses at all, chances are you don't. For most services the only function of having the email address is to spam the user. Yes, there are password resets but you don't have to force it on them, let the user decide if they want to make that fallback available to them.

For better or worse, email has become the primary way of authenticating identity, with Facebook and Google Id in second and third. Password resets are vital if your service is non-trivial, and I consider having some form of it to be absolutely necessary.

Re: Techniques To Simplify Sign-Ups and Log-Ins

#112

Post by uxp » Thu, May 05, 2011, 8:53 PM UTC

jrgnsd wrote: post #100

aristidb wrote: post #95

Earlier quoted context omitted.

A downside might be that you send passwords over unencrypted e-mail?

A fix for this can be to use a randomly generated pin or hash to act as a one time password. It will still be going over unencrypted email, but it will only be valid until the user confirms the account and chooses his own password.

And expiring after 10/30/60 days if not used. No reason to keep these useless records in the DB rotting away.

Re: Techniques To Simplify Sign-Ups and Log-Ins

#113

Post by ydant » Thu, May 05, 2011, 9:20 PM UTC

djb_hackernews wrote: post #102

mekoka wrote: post #65

Earlier quoted context omitted.

Another technique against spambots that I've used along the line of "hidden fields" is to have a textfield that should NOT contain anything at submission time. You hide the textfield (margin: -10000px) and give it a name unique enough, that browsers with autofills won't have a record of a value ever entered there. Spambots usually fill every fields, so if you see a value in the field when you process the registration…

That's wasted effort. The bots are usually built by humans, and the humans can detect that and build the bot to ignore text fields with margin < -1000 or the unique name or something.

I think it depends on if you are trying to avoid automated attacks or targeted attacks. There seem to be a lot of bots scanning for vulnerable sites - this would potentially work for those.

If you get targeted specifically, then, yeah, the human in charge can figure it out in short order.

Re: Techniques To Simplify Sign-Ups and Log-Ins

#114

Post by blake8086 » Thu, May 05, 2011, 9:43 PM UTC

lukifer wrote: post #105

aristidb wrote: post #95

Earlier quoted context omitted.

A downside might be that you send passwords over unencrypted e-mail?

I consider this huge. Aside from the obvious man-in-the-middle network attacks that could capture this easily, it also creates a huge physical security flaw: if you save/archive your emails, I can sit down at your machine, type "password" in the search box of your mail client, and trivially steal a dozen or so of your passwords. If these weren't auto-generated, it's even worse, as most people re-use passwords.

Considering the "forgot password" fallback for virtually every site is your email address, and you can't disable it, most websites are only as secure as your email security.

Re: Techniques To Simplify Sign-Ups and Log-Ins

#115

Post by BrandonM » Thu, May 05, 2011, 9:56 PM UTC

personalcompute wrote: post #61

reedlaw wrote: post #51

Earlier quoted context omitted.

Then why does Skype do it for every out-going phone call? I have to select US from the drop down list every time I make a call even though my Skype number is US based.

I remember reading in the Gnome Human Interface Guidelines (a document that defines consistency standards for gnome (linux gui) applications) that countries should always be alphabetically ordered as to not appear to favor any of them. Interestingly, it doesn't appear to be in the guidelines anymore though.

That makes a lot more sense in Gnome, a world-distributed open source project, than it does on many websites, where it's quite easy to figure out the source of the majority of your traffic.

Re: Techniques To Simplify Sign-Ups and Log-Ins

#116

Post by ydant » Thu, May 05, 2011, 10:11 PM UTC

bricetebbs wrote: post #79

periferral wrote: post #69

Earlier quoted context omitted.

Seems like an interesting proposition and makes sense overall. I can think of a few issues however. 1. You always need access to email to get access to a website. This means that for whatever reason you don't have email access, you are locked out of all sites. 2. While it works from a security standpoint, you still add overhead to the users task. Users have to go between website and email and back to website just to…

Agree on all points. But I still like the idea as an optional way for people to log quickly in without having to give the site owner any password info. And yeah its a little more tedious if the site doesn't have a long session time.

That's why I like using it in conjunction with passwords. The forget password link just provides an auto-auth one-time use link that suggests (but doesn't force) the user create their new password.

In theory, you could just continue to click "Forgot password" every time you need to log in, indefinitely. Some sites that offer this sort of functionality, that's what I do.

What I hate is when the forgot password link FORCES you to change your password. If there's a forgot password link that lets me log in easily via email, then I see no reason to be forced to change my password.

Re: Techniques To Simplify Sign-Ups and Log-Ins

#117

Post by pamelafox » Thu, May 05, 2011, 10:25 PM UTC

bane wrote: post #83

Not sure if it was accidental or not, but we ended up with the single simplest sign-up/login I've ever seen. We've even received a few emails from users alarmed at how simple it is. We're considering adding a few artificial steps (like filling out a profile) so that users feel more like they are creating an account. 1. Click login 2. Choose account provider 3. Grant us authorization access 4. Done - we pull your name…

We did that for an app, and let people pick from Google, Twitter, or Yahoo. They'd sometimes forget which one they'd chosen (like after being away from a bit or clearing the cache), and then login with a different one and get confused as to why their data was missing. Do you encounter that at all with your users?

Re: Techniques To Simplify Sign-Ups and Log-Ins

#118

Post by mauriciob » Thu, May 05, 2011, 11:10 PM UTC

lukifer wrote: post #108

portman wrote: post #107

Earlier quoted context omitted.

>> "So now only users with Javascript enabled can use your website. " It's easy to measure what percentage of your users have JavaScript disabled. For a consumer website, it's probably measured in the hundredths of a percent . If you can make a change that increases the conversion for 99.97% of your users, even at the cost of ZEROING the conversion for 0.03% of your users, then you will still come out ahead.

I would be very, very curious to see hard numbers on this. Also, it's trivial enough to add a tag advising users to turn on Javascript (with a friendly "here's how" link), or you can do the work to degrade gracefully. Your conversion might drop for such users, but there's no reason it should go to zero.

Or you could add the Captcha in this case.

Re: Techniques To Simplify Sign-Ups and Log-Ins

#119

Post by rapind » Thu, May 05, 2011, 11:16 PM UTC

Hovertruck wrote: post #4

"Use a Question Mark Icon for the Password Recovery Link" Am I the only one who thinks that is really unintuitive? I don't even think clicking on that icon would cross my mind as a user, and I would spend my time trying to find the "Forgot Password" link.

Agreed, that was an odd one (I've never even seen a site that does that). Other than that everything looked good though.

Re: Techniques To Simplify Sign-Ups and Log-Ins

#120

Post by plasma » Thu, May 05, 2011, 11:23 PM UTC

ZoFreX wrote: post #101

> use a hidden and required text field generated with client-side Javascript So now only users with Javascript enabled can use your website. I'm sure that will increase conversion. > Spambots can’t fill in the field because they can’t interact with objects in client-side JavaScript; only users can. Not true anymore. > you can create a honeypot form field that should be left blank and then use CSS to hide it from huma…

Is not having JavaScript really a problem?

I never even consider it anymore.