It's a short list but it cuts to the core with a list of the essential things that are part of successful online usability.
1. Make Them Log-In By Account Number
This is a huge one for libraries. How many libraries have databases and other electronic resources but require patrons to memorize a lengthy barcode or dig in their wallets/purses for their library card everytime they want to log-in? Then we wonder why Google gets all the attention and no one uses our expensive paid resources?
2. Enforce Complex Password Requirements
This was something I hated at UWO and which also kept me from setting up a MySpace account until long after that site had jumped the shark (which was probably a good thing in retrospect.) But yeah, if a person wants to make their password their middle name or their pet's name, more power to them. If you have fears that a password being compromised will possibly compromise your entire system, you've got bigger problems on your back end than whether somebody wants to use “Snoopy” as their password.
3. Make Them Confirm Their E-mail Address To Register
I think the reason sites do this is to confirm that somebody is a real person as opposed to a spambot. But as with the last point, offloading your security requirements to your users is bad policy that makes for a bad user experience.
4. Make Them Opt Out of Being Spammed
On top of some sites “helpfully” checking the box for “send me offers from third-party vendors”, I hate that you have to read the fine print with a microscope to know if the site requires you to check the box to get out of being spammed, uncheck the box to get out of being spammed, check the box to receive the offers or uncheck the box to receive the offers. I'm surprised they don't alternate the boxes from page to page (wait, don't tell them I said that! 😮)
[Edit: I noticed that someone in the comments added “#5 – Don't make the user change their password in a greater frequency than they use the site.” This is a personal pet peeve of mine. We have to change our Dynix password at work on a monthly basis which is a pain but okay, fine. I'm on there everyday. But I bet the easiest way to find all the personal information on anybody in our library system is to break into one of our branch libraries – which are all in small towns and few with an alarm system – and look under the mouse pad or in the top left drawer since the librarians are all changing their passwords so frequently when they're only open a couple days a week – that I'm fairly certain they write the passwords down to keep track of them and also so others with access to the system – assistants and occasionally board members – can also log-in. It's beyond obvious to point out that any password system that encourages people to write down their passwords defeats the purpose of having passwords!]
Comments 6
i still use my UWO password – so complex but muscle memory keeps it useful!
Amen to the passwords! I have to change mine every month at work to log on to the network as myself (ie: to access the files that I choose not to store on the shared files), and you can't repeat a password within 24 times. Add that to all the other passwords I have to know – security codes, logging on to the branch computer the branch email, my own email, the computer booking system – and I've resorted to writing them all in my day planner.
Which is why I had a mini-freak-out when I, ah, misplaced it over a few days.
That doesn't even begin to cover passwords needed for personal use sites like Facebook, Hotmail, UWO, Chapters, my online banking, etc. To me, if someone chooses to use the same password for all their accounts (who, me?) then it's their own damn fault if something happens, but they shouldn't be forced to submit to all kinds of restrictions. We all belong to so many sites which require a username, login, password – how the heck do people keep it all straight? Hell, many patrons have a hard time finding their library card in among all the rest of the cards they carry. It's the same deal with memorizing numbers and passwords.
Now … before I post this comment, I have to think: what's my Username and Password?!?
My Mom is a nurse, and they had to change either password on the morphine pumps monthly – so she alternated between two. When they changed that so there has to be a new password, it was a bad scene.
Here's another one for you: don't make your users “choose” from a drop-down menu with ONE OPTION! (I've seen it more than once…)
Emily
Ack – I never want to see mine again! (Although you're right about muscle memory – I'll probably be able to type it without thinking for the rest of my life!)
Yeah, we have that “you've already used that password in the last few times” limitation on ours which *really* sucks. I could *almost* deal with it if I could flip back and forth between two passwords. But do you know how hard it is to come up with variations of “123ABC” every few weeks? (That's not my real password but you get the idea.)
One thing that really sucks about the sites that prescribe a format/limitation for your password is that if you *do* have a system to create different but recallable passwords for each site (I've heard of one where you have a single beginning word – “barb” or whatever – then use the first or last letter of the web site URL (right before the .com/net/ca/etc part) in numeric form after it. So, since B is the second letter of the alphabet, your password for this site might be “barb2”. For increased complexity, you can use both the first and last letters – the “b” of “blog.jason…” and the “d” of “hammond.net” that comes right before the domain type. Ergo, barb24.
The possibilities are endless and I use a variation of this technique myself. Then, barring a change in the web site URL, your passwor is always right there in front of you!
My mom's a nurse too! Asking nurses to change passwords regularly on life-threatening/saving machines is probably a BAD idea any way you look at it.