Hacker News Reader

For a project I'm working on right now our team decided to simply eschew user accounts even though it's a site that is built around user generated content and comments. Everything is done by entering your email address (which the site doesn't surface) and then clicking a confirm link we send via email.

So far,our testers love it. It seems to have gotten them quickly past the user dread. It also means your first participation in our site can happen by submitting one form and confirming one email. That's somewhere between two and five steps shorter than had we required account setup. While it adds an extra step to subsequent interaction, email confirmation, we feel like it's a good trade off for them. After all, going through a password reset when you come back to the site is an easy way to lose people.

And for us, it eliminated a lot of development headaches. When a user first participates in the site we assign them a randomly generated username. And they can change it to whatever they like ... They just fill put the change my username form and confirm by email.

Obviously, if we wanted to save credit card info or something like that we might need to modify this approach for PCI compliance, but I believe a fundamentally similar workflow could be employed even then.

I'm not sure I understand, you're saying that you are sending an email for every login? It surprises me that your testers seem to love that, it seems very obnoxious to me. I also don't quite understand:

> After all, going through a password reset when you come back to the site is an easy way to lose people

Most password reset forms I've seen just ask the user for their email, send them a link and ask them for a new password. This is nearly the same flow as your regular login flow, if I understand correctly?

I'm guessing there is a long (week or two) session cookie that they only need to re-confirm their email after a few weeks of not being on the site... maybe as a secondary token/cookie to re-entering their email, if it matches the second token, they're in...

It'd be similar to 2fa, but without the first factor (a password).... I work on a similar site, where each real interaction is a financial transaction... since there's no real need to login after that transaction, there's no password, they're buying a product, and that is delivered via email... no need for the hassle of creating an account to login with... an account is made with a random password under the covers, but it's never really needed.

You're my hero, never stop being amazing!

I disagree. The OP is talking about usability, first and foremost. Everything you said is true, but none of it speaks to usability and UX.

I agree so strongly with the bulleted points made, that it made me imagine a standard, a symbol of compliance. Sites complying with all 6 points could use some sort of validator, like W3C.

Sites/apps that make me sign up for something trivial, sign up through FB only, won't allow me to use my global identifier (my email), or limit the length of my password, are often rejected (by me) out of hand. I simply don't have the time or the patience to deal with their special circumstances and they need me more than I need them, 99.9% of the time.

This is great consolidated advice.

Not sure you guys disagree! The parent said, "Maybe you don't display it as an "account", but I can't think of a single commercial website where you shouldn't at least be taking an email address as part of the transaction."

Then #3 on the bulleted list of six points says, "Username = Email. Don't make people remember a username for your site. You may allow them to pick a username later on that can be used in lieu of their email address, e.g. as the URL for a profile page, but don't force them to use a username to log in."

The quoted list is under "and if you do offer accounts..." on the blog post, and that's totally, utterly wrong for many sites. So yeah, if the OP thinks this advice is good enough to merit a verification badge, we disagree. The advice is bad.

It can make all the sense in the world to make "accounts" a very lightweight thing. But if you're taking payments or doing anything that might conceivably result in a user support request (e.g. storing user data or taking some action on their behalf), then you need to have some form of registration. And once you have registration, you'll need to have some way to prevent drive-by registration by total strangers -- otherwise you'll start getting complaints from people that some jerk/spammer signed them up for your site.

There are reasons that this stuff exists, and authentication always deserves careful thought.

Man, I'd get behind a standard and stamp for this, it'd save me so much time!

I'm sick of accounts. Fuck accounts, I've got hundreds of the little shits, every one a looming security time bomb. Most of them I cannot delete. I've just stopped making them now, which locks me out of pretty much every new product, but I consider it worthwhile in exchange for not creating more accounts.

There are better ways of doing this shit though. For example, firefox hello does not require an account like skype does. It just makes a hyperlink with a unique ID, and I can share it.

If you need to track the customers transaction, why not link it to a unique URL?

"most of this advice is too general to be good"

I guess what bothers me the most about "advice" like this is what makes the person stating the advice qualified to give the advice? This is not to say it's right or wrong but with all due respect to all those on HN that are still in college (such as Ben the OP) why do you feel that you are uniquely qualified to offer this? Noting that you posted it to HN and not a third party that somehow tripped on it ...

OP do you care to give your thoughts?

I could have provided a clearer intent in my post, but here goes.

These are simply usability guidelines that I've built up over my time interacting with hundreds of websites. I find myself annoyed by certain things over and over, so I decided to put them together in the form of a list. I don't believe I am more qualified to write this than anyone else who has spent a decent amount of time on the Internet.

Furthermore, there are always exceptions. I'm not implying (or I hope people are not inferring) that no site should ever provide a sign-in/account feature. You may have a compelling reason to provide this, and that's great. But don't allow or require people to do this when it offers them no value.

First, thanks for giving your thoughts and responding.

I think that when you say this (as you did in the blog post):

"here are a couple of rules to follow to ensure a good user experience:"

...particularly using "rules" you have to keep in mind that anyone and everyone could be reading your post.

And they very well might think that you are more qualified in your opinions than someone who has come to those conclusion by observation [1] and therefore give those "rules" greater authority than they deserve. Since, by your reply to my question, you say are actually just "simply usability guidelines that I've built up over my time interacting with hundreds of websites".

Now of course if you are a business offering to sell a product or service I for one think that it's a good idea to be definitive and state an opinion in many cases as if it's a fact. Regardless of whether it is or not. [2]

[1] Which of course we all do from time to time.

[2] But even with that I would never tell people in a blog post that this is a "rule" just something that I feel (and for what reason) is appropriate from my perspective.