New Approaches To Designing Log-In Forms

http://uxdesign.smashingmagazine.com/2011/08/22/new-approaches-to-designing-login-forms/

by cwan • 15 years ago

54 27 15 years ago

uxdesign.smashingmagazine.com

Tichy2• 15 years ago

Revealing user names (As in "you are trying to log in as Luke") is usually considered a security issue, though.

phlamb• 15 years ago

This was my first thought as well. I thought it was bad when it just verified that you had used a correct username after attempting to log in, then I kept reading and saw the auto-complete combobox of usernames...

trafficlight2• 15 years ago

That combobox was baffling.

pbreit• 15 years ago

My first thought was: what about duplicate names?

dunham• 15 years ago

I believe revealing whether or not an email address has an account is also considered a security issue.

pornel• 15 years ago

Validation on registration form reveals this already.

danellis• 15 years ago

Probably doesn't make much of a difference on those sites that have public profiles, though. They typically have the username in the URL anyway.

snorkel• 15 years ago

... and not to mention a user privacy violation.

olefoo• 15 years ago

Yes, and in this case the designer made a (hopefully conscious) decision that usability was more important to the user than the information that an attacker would gain. These sorts of decisions are the hard part of building web applications; there's no right answer applicable to all situations, you have to use judgment and experience to gauge how to balance the competing needs of your users and your business.

huhtenberg2• 15 years ago

How so? Please do elaborate.

(edit) In a context of a system that allows anyone to register new account, which appears to be what the linked article focuses on.

Tichy2• 15 years ago

It's probably a minor issue, but if you can check for existing user names, you have a much easier time trying to find the matching password. Also, it could be a privacy issue (knowing user x is a customer of service y). Showing a photo as well...

Of course it depends on the context. On Hacker News all user names are visible anyway.

lambada• 15 years ago

Didn't Facebook get bad press a while ago for revealing the user's name and profile picture when an incorrect password was entered?

thatjoshguy• 15 years ago

If you mistype your email address in Facebook, it will suggest your correct account on login fail. I'm not sure if it just does this blindly, or if it tracks where you are logging in from.

bitdiffusion• 15 years ago

I was always under the impression that security trumps user-experience in the majority of cases - what happened to trying to prevent malicious users from harvesting user names by using captcha, non-specific error messages etc? Maybe I've had my head buried in the security game for too long...

owenmarshall• 15 years ago

Security should trump UX. In practice, though, UX almost always seems to trump security concerns.

Silhouette• 15 years ago

> Security should trump UX.

Yes and no. Of course security is important, but no realistic system is ever known to be completely secure, so it's always a cost/benefit question.

If you take security far enough that your system ceases to be useful, then UX certainly won't matter, because you won't have any users.

More commonly, if you make security checks too disruptive, it can be counter-productive because users will start to circumvent the system. Consider all the stories you've heard of someone changing their "updated monthly" password by just adding the next number on the end, or writing the PIN for their credit card on a bit of paper they keep in their wallet, or having a note of their network password taped inside their desk draw. Or just be the guy at Microsoft who invented UAC in Vista. ;-)

wpietri• 15 years ago

> Security should trump UX.

In my view, security is just another part of the user experience. For one's bank, it's surely a large one. For most web services, though, it's pretty tiny. As a Quora user, I'm perfectly happy for them to increase usability substantially at the cost of a minor increase in risk.

typicalrunt2• 15 years ago

So for the Quora login form that determines whether someone's email address has already registered on the system... What's to stop me from: - looking at the source code, - finding the JavaScript call to the REST service that checks for an account - writing a script to loop through all well-known domains and usernames?

Tada! Instant email scraping tool.

typicalrunt2• 15 years ago

Actually, I re-read the article just to make sure that I wasn't being too critical. I'm not. The author doesn't mention any security risks/benefits associated with the new login form designs.

It reminds me of the time when a former boss asked me to add authentication onto the company intranet. She wanted to know who is logging in and viewing private documents, but she didn't like typing in or remembering passwords so I could only ask users for their username and "trust" that they wouldn't type in someone else's username instead. For some (probably most) users, security isn't on the forefront of their mind, so they need to be reminded of it.

yesimahuman2• 15 years ago

Here is another one I've experimented with: No passwords. You get a login key in the first email we send, or you can request a new email to log in.

Your email is the weakest link in a lot of password-based schemes anyways, but this approach is less secure and a bit confusing.

pagekalisedown• 15 years ago

This is a great idea, but is it hard to implement with non-technical users?

yesimahuman2• 15 years ago

I would just say that people aren't used to it. Also you need to decide how you want to send the email. Once on signup (long-lived token, not recommended), once a day (weird, annoying), or on demand (user gets email instead of entering password).

I think it's interesting but in practice passwords are more secure and people are used to them.

ianhowlett• 15 years ago

I wouldn’t be happy, as a user, if I saw that information like this was made public about me on a site.

New Approaches To Designing Log-In Forms

Related Stories