Password-only Login

Jason Fried at 37 Signals recently asked:

…What benefits are gained by doing away with the username and password process and replacing it with a cryptic URL that you can’t remember?

Users bookmarking unmemorable, arbitrary URLs will find it difficult to access their account from other machines. You can provide username/password access as an alternative but then you're back to square one.

Randomly generated passwords have problems too; users must either write the gibberish string on paper or change it, usually choosing the same password they use for their web email account. Chances are they've probably given you their email address to, so by this point, you have all the information you need to get into their account which they might see as a bad thing.

So…

Use just a passphrase?

Make it comprise two adjectives and a noun so it's easy to remember, e.g.

• blue folded caliper

The user, on signing up, is presented with a choice of five such passwords from which they choose one.

When logging-in they use this one passphrase, nothing else.

The system would ignore spaces and not be case-sensitive, thus allowing for common typos.

Read more about this approach in The Humane Interface by Jef Raskin, chapter 6, Navigation and Other Aspects of Humane Interfaces. It'll make a lot more sense than this rambling post I'm sure.

Partially written by a human