Missing Features

Wesabe is an outstanding personal finance web 2.0 start-up. The site pays careful attention to usability and is overall efficiently designed. Well, almost.

The site architects made one major design blunder in a process every user has to use every time they visit Wesabe: the login user name is not email.

Why should your correspondent have to remember a user name for this site? Users already suffer from password overload, mostly due to the design and implementation failure of distributed authentication systems.

To add to this burden many sites — like Wesabe — force a user to remember an extra piece of authentication. Wait! You might argue this is more secure.

Wrong. There simply isn’t a positive security argument for this. In fact, since a user has to remember more stuff, it’s more likely to get written down and stored on a sticky on the monitor (or in the top desk drawer).

Here are some general rules for designing login systems on websites:

1. The login user name should be the user’s email;
2. You should label the user name field email because that is what you want from the user, their email address;
3. Just about every standard ASCII character should be allowed in passwords, from about 21 to 126 (unicode support coming soon!); and,
4. The submit button for the form should look like a submit button and be called Login.

Trackback URI |