21–30 of 114 posts
We run a service that makes it simple to add Email&Password style login, or Social login to your site: http://www.dailycred.com
[1] http://dailycred.tumblr.com/post/30602034530/surprise-people...
We've always found that by replacing "username" with "email address" makes logging in a lot easier. Most users already know their email address. By using a username thats one more thing they have to remember.
Using an email address instead of a username is SO HUGE of a usability win. I can't stand when companies don't do this. My email address is going to be unique. I don't have to pick one of the few standard usernames I use and hope that it's available. I know my email address will be. Have you ever been to a site that says username, but really wants an email address? It's absolutely infuriating.
If you have a catch-all error message, it's much harder to guess the username/password combo.
Mailchimp found that clarifying login error messages reduced login failures by 66%!!
The rest of the story is a coincidental tale about the CEO trying to pull a "Jobs" by thinking he knew what his customers wanted better than they did. The social media buttons only had an effect on 3.4% of their users, a small group compared to the reduction in failed logins. By making the social login buttons the main point of their blog article, they hide this valuable tidbit.
One thing that jumped out at me with the "better" error messages, is that it makes it that much more hackable - if I can hit the service and find valid usernames, I can then try to get into those. If you have a catch-all error message, it's much harder to guess the username/password combo.
One thing that jumped out at me with the "better" error messages, is that it makes it that much more hackable - if I can hit the service and find valid usernames, I can then try to get into those. If you have a catch-all error message, it's much harder to guess the username/password combo.
Test your changes independently, and make incremental changes
They thought social buttons improved login success. They didn't. An unconnected copy change improved login success. If you test these things independently, you'll get much better insight into what makes a difference.
One thing that jumped out at me with the "better" error messages, is that it makes it that much more hackable - if I can hit the service and find valid usernames, I can then try to get into those. If you have a catch-all error message, it's much harder to guess the username/password combo.
They decided that the net result outweighed the increased risk.
On one of my previous projects, Twitter was the only allowed login method. After some complaints, we implemented an email-based login and reduced the bounce rate by over 50%.
Another anecdote: whenever my Asana session expires, I always struggle to remember which Google account I registered with or if I used email. The worst part of their flow is that if you're wrong, a new account is created and you login to a blank slate. It takes forever to find the log out button to try again too.