11

This question came up today while discussing with a colleague about the 'create account' page for the website we're working on.

My colleague's opinion is that we should make the registration as quick and seamless as possible, therefore we should just ask the user for his email and take care of the rest.

I agree with the intention, but I have a few concerns about it:

  • Since we generate the password, we have the responsibility to make sure the password is strong enough
  • In my experience, when confronted with an unintelligible password, users are likely to write it down on a post it
  • The users who do not write the password down, are pretty likely to forget it. Which means they'll have to ask for a new password regularly, and that's not fun for anyone

However, considering the general quality of passwords created by users, and the fact that too many people tend to use the same password for everything ('shudders'), I can see how it would make sense to generate a strong password for them.

I still feel torn about it. We are working on a merchant website where the user has the option to save his credit card details, so it is obviously very important that we use most secure approach.

Improve this question
7
  • 3
    I suppose someone has to reference this: xkcd: Password Strength
    – candied_orange
    Commented Oct 27, 2017 at 0:45
  • @CandledOrange Obligatory XKCD reference
    – Dryr
    Commented Oct 27, 2017 at 0:56
  • 11
    As a consumer, the moment I use your site and you generate a password for me is the moment I delete my account.
    – Eric King
    Commented Oct 27, 2017 at 1:16
  • 4
    Maybe this question is more suitable for User Experience SE. There is already a similar question with interesting answers as well: Would you get rid of password field in sign-up form.
    – insertusernamehere
    Commented Oct 27, 2017 at 5:27
  • 19
    Emails are not a secure communication channel. Do not send passwords via email. Tokens that are only valid for a short amount of time (e.g 24 hrs) might be ok. You can't avoid passwords, but you may encourage use of password managers: dedicated software, "remember my password" browser features, and physical notebooks are all legit strategies. Providing a password does not encourage good security habits. Additionally implement login options like "sign in with Google" where you don't store passwords. Use external payment processors so that I don't have to trust your site with my payment details.
    – amon
    Commented Oct 27, 2017 at 6:09

1 Answer 1

Reset to default
11

The advntage of the email approach is that you ensure by this way that the user did provide a valid email account that he/she controls.

However, the email channel is notoriously insecure. This means that the password could be intercepted. So this approach should only be considered if the generated password is used only once, at first login, and if it's ensured that the user must change it.

The direct approach is more secure, in the sense that a tls/ssl connection to your website is much more difficult to intercept without being noticed.

Improve this answer
2
  • 2
    Usually, both approaches are used together: enter email and password, then receive an email containing an activation link.
    – mouviciel
    Commented Oct 27, 2017 at 8:59
  • @mouviciel yes, en effet. This two-step approach with password and link seems to be the most common approach used, and certainly not without reason :-) It's safer, because in general the activation link is only used for activation and not for login. For the OP, this would require the development of the logic for sending the activation link and tracking of activation on account.
    – Christophe
    Commented Oct 27, 2017 at 12:06

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.