Easier account signup using email codes

[Jonathan5]

Here are other problems.

You’re at /login and type your username in the “Email/username” field. After the initial confusion I mentioned above, you click “Email me a one-time login code”. This brings you to the “Welcome back” page, where the “Email” field is pre-populated with your username (problem no.1). When you absent-mindedly click “Continue” you get three red messages all at once (problem no.2):

1. Incorrect username, email or password
2. Fix this error to continue - Email - Please enter a valid email address
3. Please enter a valid email address

The “Login with your password instead” text beside the next “Continue” button looks a bit like a description of the Continue button, but that’s not a big problem.

Then you click “Continue”. It goes to the “Welcome back - Check your email” screen, but the “Incorrect username, email or password” error is still there (problem no.3).

Here, the extra links (“Resend code”, “Use a different email address”) are below “Continue” and it’s clearer they’re something else.

[rishabh]

@pmusaraj

One is random username generation, which we are shortly going to switch to default off because you are right, it’s not a great default for all communities.

Adding a note here to confirm that going forward, random username generation is not enabled by default along with this upcoming change, and is fully opt-in. The first post of this topic has been updated accordingly.

Thanks to everyone here for the feedback.

[ecki (Bernd)]

Personally I hate when verification or login mails have no links to click, so I would appreciate if you add an option to turn this as site preference.

having the email and the code as the first signup step is nice, but I wonder if entering an email (and sending a mail) without agreeing to data protection terms is acceptable? As already mentioned, it needs to fit into moderator approval (I.e. don’t send “activate your account” if that is not a given)

[pmusaraj (Penar Musaraj)]

@ecki

add an option to turn this as site preference

This is not an easy thing to satisfy, for two reasons. First, it’s best for the product to have one mechanism for confirming ownership of an email address. Having two mechanisms in place is confusing for end users, admins and our own support team.

The second reason has to do with security. A link can be more easily hijacked or manipulated by a potential attacker. For example, it’s easy for someone to send an email that looks like it’s from a legitimate site, with a link that also looks like it, but that instead takes the user to a different site or account. Links make social engineering attacks easier to implement. Email codes, less so.

@ecki

I wonder if entering an email (and sending a mail) without agreeing to data protection terms is acceptable

Should be fine for a one-time email, no? I’m not sure how this is different when sending a link or a code, in any case.

[Takiro]

Is there a way to get the custom user fields that have “show on signup” or are required at sign up to show up on this new sign-up page? On my forum we have options like “opt into artwork of the month” that users got shown previously when signing up. While this is a nice thing it unfortunately circumvents entering and showing important login fields.

[Jonathan5]

@Takiro

custom user fields

Yes, in my experience… as long as users aren’t prevented from changing their username!

@Jonathan5

2. A screen (not mentioned in this topic) appeared before the username one, asking for Full name and custom fields to be entered. This is good. But this also DID NOT APPEAR before. The difference doesn’t make any sense.

[MDNJ]

Indeed it doesn’t work for me either when setting an invite code.

It just fails to send an email code without warning or error message.

Had to make it invite-only as a result. But it’s great to have this signup method. When forcing 2FA is not an option. It’s certainly more secure than having users set a generic password that they’ve probably used many times before.

[TimMOz]

Hi, this seems like a good move, but it adds an extra round of emails.

We have invite only, and we send individual invites by email.

Previously, the email signup link includes the extended token that allows signup without requiring another step of email verification.

With this switched on, it emails the short-form token, that then requires another round of email.

Makes the signup process more complex for new users.

[rishabh]

Yes, this system doesn’t show user fields on the signup form but it does show them after the code is confirmed in the next step.

Have you tried testing how this page looks for fields you have set up?

[MDNJ]

@rishabh

Over to you: we’d love to hear what you think of this new feature. What do you like and dislike; what is working well, and what could be improved?

So signing up has been great for users who are not too technical. Just enter your email in the box, wait for the code and you’re in. And it’s relatively secure.

Some things I’ve noticed so far:

• The fact that using invite codes is broken as mentioned before.
• The amount of time you get to enter the numbers is very very short for the people that i work with, and the code probably longer than it needs to be. Neither is adjustable if I’m not mistaken, and neither seem to make it more secure - only more difficult.
• While signing up with just an e-mail box is great. It doesn’t make much sense that the next time you sign in there is suddenly a password that you ‘need’ to enter. As mentioned the users that i work with are not too technical, so when signup using email codes is the default, having a password box (possibly weeks later) is confusing. The expected standard these days is to have an email box only and have the system decide to either ask for a password or email code or other only afterwards.

[Takiro]

Yes I tested it but after entering the code the user is redirected to the forum instead of to the custom form fields.