Improvement of user experience for WordPress default login mechanism

– Accepting the email address instead of the username to allow logins has been discussed, but is not really possible because of the legacy of the username feature. Usernames can contain @ symbols, basically, so you run into a conflict where you can create a username using somebody else’s email address and thus prevent them from being able to log in properly.

– The changes to the password system were intentional and part of a general hardening of user security.

There are inherent issues built into the standard “enter twice” system.

Basically, the enter twice mechanism entirely stems from hiding the password. You can’t see what you’re entering, therefore enter it twice to confirm what you’re typing is what you think you’re typing. Users are used to it, however it is not secure because it inherently limits the space in which users select passwords. Complex passwords are typically not chosen by the user because they’re harder to enter. The fact that you have to enter it twice combined with being unable to see your mistakes and typos means that most users choose terrible passwords. And like it or not, brute-force password guessing is *extremely* commonplace on the web today.

Showing the user the password, and choosing a good one for them in advance, provides better security. Ideally, we don’t *want* the user to change that password. It’s actually better for them to write it down than to choose a bad password, because while the sticky-note-attached-to-the-monitor is insecure, it’s a heck of a lot more secure than a password which is some common word or name followed by the year of your birth. Especially against remote brute-force attacks.

Yes, the user can enter their own password in this field, but anything they enter is likely to be worse than the generated one given to them, so ideally, they won’t enter it, and if they do enter a bad password, a checkbox appears to make them confirm that yes, they’re doing something bad for their own security.

Usability is great and all, but the truth is that security is important too, and really, usability is also about more than just “what the user is used to”. Just because they’re used to a bad two-field security practice doesn’t make it the best approach, nor the right way to do things.

Thanks Samuel for the detailed feedback. Here are my two cents:

– I did not know the username convention inherent limitation (accepting @ characters). In this case, could it be possible to clarify a bit the login system to people by putting a grayed out example of the kind of data they have to enter in each login field? I have already seen this on other websites, and it is very effective for computer-illiterate people IMHO. For example:
– ID: grayed out johnsmith
– Email: grayed out [email protected]
– Etc.

– I fully agree that the “enter password twice” system is due to the hidden password feature. But there are IMHO at least four alternatives to the current WordPress reset password system:
1) Go back to the “enter twice” option with a check-box “show password” (not very satisfactory, I agree).
2) Keep the single, visible password entry system as it is, but do not automatically generate a random password. Instead, provide a button “generate random password” for those people who wants it. (And change the label on the current OK button, which IIRC is labeled “generate password”, instead of a plain “OK” or “save password”.)
3) Enforce a certain password quality: if the provided password does not pass the current evaluation test, it is not considered and people have to provide another one… Very effective!
4) Enforce logging with third-parties authentication systems with two-step verification approaches (Google… and WordPress.com, in a sense).
A combination of 2) and 3) is my favorite alternative to the current reset password system.

What do you think? Thanks again for your help.

WordPress 4.5 will contain the login by email feature. As for the passwords, I stick with my original assessment. What we have now is better, even if not the usual case.

2 factor is in the works and I like what we have so far. Good forward direction there.

Thanks a lot Samuel for the good news! I am looking forward to trying WordPress 4.5!