Why require username for forgotten password?

Do not post support requests, bug reports or feature requests. Discuss phpBB here. Non-phpBB related discussion goes in General Discussion!
Suggested Hosts
User avatar
Albert Wiersch
Registered User
Posts: 140
Joined: Sat Dec 11, 2004 6:00 pm
Location: Dallas, TX
Name: Albert Wiersch
Contact:

Why require username for forgotten password?

Post by Albert Wiersch » Fri Oct 28, 2011 3:43 pm

This seems to be a big usability problem - requiring the user to remember their username if they forgot their password. Why not only require an email address to send them a reset password link?

Sure, requiring a username is more secure, but not having a forum at all is even more secure... when security gets too much in the way then it's not always a good idea.

Am I missing something? Is there an option to allow only an email to resolve a forgotten password issue? If not, then I think there should be.

Thanks.

User avatar
canonknipser
Registered User
Posts: 1713
Joined: Thu Sep 08, 2011 4:16 am
Location: Germany
Name: Frank Jakobs
Contact:

Re: Why require username for forgotten password?

Post by canonknipser » Fri Oct 28, 2011 4:10 pm

My personal opinion: for me it's easier to remember my username than one of my different email-accounts (normally i use different for every website, which will be forwarded to a global account just for spam-protection)
Greetings, Frank
phpbb.de support team member
English is not my native language - no support via PM or mail
New arrival - Extensions and scripts for phpBB

User avatar
Mick
Support Team Member
Support Team Member
Posts: 20383
Joined: Fri Aug 29, 2008 9:49 am
Location: Cardiff

Re: Why require username for forgotten password?

Post by Mick » Fri Oct 28, 2011 4:26 pm

There's an UNVALIDATED MOD for Changing methods for password reset but, be aware, this MOD is marked as [RC] so you should double check with the author that it is safe to use before you use this MOD on a live board.
"The more connected we get the more alone we become" - Kyle Broflovski

There are no ‘threads’ in phpBB, they are topics.

User avatar
Albert Wiersch
Registered User
Posts: 140
Joined: Sat Dec 11, 2004 6:00 pm
Location: Dallas, TX
Name: Albert Wiersch
Contact:

Re: Why require username for forgotten password?

Post by Albert Wiersch » Fri Oct 28, 2011 6:04 pm

Mixstar wrote:There's an UNVALIDATED MOD for Changing methods for password reset but, be aware, this MOD is marked as [RC] so you should double check with the author that it is safe to use before you use this MOD on a live board.
Thanks. I think I won't do anything if it requires a MOD, especially an unvalidated one, unless I get more complaints (though I suspect most users won't complain, they'll just leave). I'll just hope this is improved in a future version. I really think it is a pretty bad design that can easily frustrate users into leaving a forum and not coming back when they can't address a forgotten password issue.

User avatar
canonknipser
Registered User
Posts: 1713
Joined: Thu Sep 08, 2011 4:16 am
Location: Germany
Name: Frank Jakobs
Contact:

Re: Why require username for forgotten password?

Post by canonknipser » Fri Oct 28, 2011 6:18 pm

I never heard about a user leaving a board for the reason he forgot both username and password.
Normally, a board should also have a valid contact address for mail, so if someone forgets his username and password, he can contact the administrator(s).

Or just create a new account ;)
Greetings, Frank
phpbb.de support team member
English is not my native language - no support via PM or mail
New arrival - Extensions and scripts for phpBB

User avatar
Mick
Support Team Member
Support Team Member
Posts: 20383
Joined: Fri Aug 29, 2008 9:49 am
Location: Cardiff

Re: Why require username for forgotten password?

Post by Mick » Fri Oct 28, 2011 6:19 pm

Albert Wiersch wrote:I'll just hope this is improved in a future version. I really think it is a pretty bad design that can easily frustrate users into leaving a forum and not coming back when they can't address a forgotten password issue.
FWIW - If users can't remember their usernames what chance have you got of them remembering their email addresses?
"The more connected we get the more alone we become" - Kyle Broflovski

There are no ‘threads’ in phpBB, they are topics.

User avatar
Albert Wiersch
Registered User
Posts: 140
Joined: Sat Dec 11, 2004 6:00 pm
Location: Dallas, TX
Name: Albert Wiersch
Contact:

Re: Why require username for forgotten password?

Post by Albert Wiersch » Fri Oct 28, 2011 7:13 pm

canonknipser wrote:I never heard about a user leaving a board for the reason he forgot both username and password.
Normally, a board should also have a valid contact address for mail, so if someone forgets his username and password, he can contact the administrator(s).

Or just create a new account ;)
Sure, they could do that, but some (many?) will not want to go through the trouble. Things should be made as easy as possible or some members will go elsewhere. :D
Last edited by Albert Wiersch on Fri Oct 28, 2011 7:15 pm, edited 1 time in total.

User avatar
Albert Wiersch
Registered User
Posts: 140
Joined: Sat Dec 11, 2004 6:00 pm
Location: Dallas, TX
Name: Albert Wiersch
Contact:

Re: Why require username for forgotten password?

Post by Albert Wiersch » Fri Oct 28, 2011 7:14 pm

Mixstar wrote:FWIW - If users can't remember their usernames what chance have you got of them remembering their email addresses?
A lot better chance of remembering an email address than a username.

User avatar
canonknipser
Registered User
Posts: 1713
Joined: Thu Sep 08, 2011 4:16 am
Location: Germany
Name: Frank Jakobs
Contact:

Re: Why require username for forgotten password?

Post by canonknipser » Fri Oct 28, 2011 7:54 pm

Albert Wiersch wrote:
Mixstar wrote:FWIW - If users can't remember their usernames what chance have you got of them remembering their email addresses?
A lot better chance of remembering an email address than a username.
Are you serious that mail "dromedar7926@desertmail.tld" is easier to remember than user "camel"?
Greetings, Frank
phpbb.de support team member
English is not my native language - no support via PM or mail
New arrival - Extensions and scripts for phpBB

User avatar
Albert Wiersch
Registered User
Posts: 140
Joined: Sat Dec 11, 2004 6:00 pm
Location: Dallas, TX
Name: Albert Wiersch
Contact:

Re: Why require username for forgotten password?

Post by Albert Wiersch » Fri Oct 28, 2011 8:01 pm

canonknipser wrote:Are you serious that mail "dromedar7926@desertmail.tld" is easier to remember than user "camel"?
For the user who's email address it is, then yes, it's easier for a typical user to remember their own email address than all their username(s) on all the forums and websites they are on... and if they can't remember their email address, then it's much more likely they have it written down somewhere than they have their username written down somewhere.

Besides, the forum requires BOTH username and email address... so remembering only their username isn't good enough anyway.

User avatar
canonknipser
Registered User
Posts: 1713
Joined: Thu Sep 08, 2011 4:16 am
Location: Germany
Name: Frank Jakobs
Contact:

Re: Why require username for forgotten password?

Post by canonknipser » Fri Oct 28, 2011 8:13 pm

OK, about which percentage of users do you talk forgetting both username and password? 0.1%, 0.5%?
  • Afaik all modern browsers allow to store form data, so on home PC there is normally no need to remember it by human, the electronic can do it
  • If somebody has a bad memory, he can use an old-style notebook (made of paper) or an electronic equivalent to notice his account details, which are web-address, username, password and email-address
I use more mail-adresses than usernames, so forgetting the email-adress happens more often to me than forgetting the username
Greetings, Frank
phpbb.de support team member
English is not my native language - no support via PM or mail
New arrival - Extensions and scripts for phpBB

User avatar
Albert Wiersch
Registered User
Posts: 140
Joined: Sat Dec 11, 2004 6:00 pm
Location: Dallas, TX
Name: Albert Wiersch
Contact:

Re: Why require username for forgotten password?

Post by Albert Wiersch » Fri Oct 28, 2011 8:37 pm

canonknipser wrote:OK, about which percentage of users do you talk forgetting both username and password? 0.1%, 0.5%?
I don't know... not many, but I'm sure the vast majority don't say anything about it.
canonknipser wrote:Afaik all modern browsers allow to store form data, so on home PC there is normally no need to remember it by human, the electronic can do it
The key word is "normally". What happens when the abnormal occurs?
canonknipser wrote:If somebody has a bad memory, he can use an old-style notebook (made of paper) or an electronic equivalent to notice his account details, which are web-address, username, password and email-address
Sure, but how many people actually do this? In any case, why make it more difficult for the user than it has to be?
canonknipser wrote:I use more mail-adresses than usernames, so forgetting the email-adress happens more often to me than forgetting the username
See! It happens to you too. :D Only it's the email address you forget... for most people, I suspect the situation is reversed and they forget their usernames because they use only one or two email addresses.

User avatar
stevemaury
Support Team Member
Support Team Member
Posts: 49750
Joined: Thu Nov 02, 2006 12:21 am
Location: The U.P.
Name: Steve
Contact:

Re: Why require username for forgotten password?

Post by stevemaury » Fri Oct 28, 2011 8:41 pm

Not a support topic. Moving to Discussion.
For REALLY good and VERY inexpensive hosting CLICK HERE

I can stop all your spam. PM or email me.

All unsolicited PMs will be ignored.

User avatar
Albert Wiersch
Registered User
Posts: 140
Joined: Sat Dec 11, 2004 6:00 pm
Location: Dallas, TX
Name: Albert Wiersch
Contact:

Re: Why require username for forgotten password?

Post by Albert Wiersch » Fri Oct 28, 2011 8:51 pm

stevemaury wrote:Not a support topic. Moving to Discussion.
OK. I was hoping there was an option to address this that I missed but I guess not. :cry:

Oh well, hopefully not THAT big of a deal but I do feel it should be addressed in a future update.

Over & out.

User avatar
EXreaction
Former Team Member
Posts: 5666
Joined: Sun Aug 21, 2005 9:31 pm
Location: Wisconsin, U.S.
Name: Nathan

Re: Why require username for forgotten password?

Post by EXreaction » Fri Oct 28, 2011 9:43 pm

Please use the bug tracker to request improvements:
http://tracker.phpbb.com/secure/CreateI ... fault.jspa

I feel like you have a valid point, requiring both does not seem to have any advantages.

Post Reply

Return to “phpBB Discussion”

Who is online

Users browsing this forum: Mathieu M. and 35 guests