1

From what I have noticed, there is very few services that offer the Remember Email over Remember Me or Sign-in Automatically.

These options really do make the life easier for the end-user of applications. I strongly think that Remember Email would be way better with making the user input their password into the password field. Also, it would boost security with doing it that method (e.g. CreditKarma as an example).

Would it be more secure if we do Remember Email and make our users put in their passwords each time they have to login to systems?

  • 1
    “Remember e-mail” seems pointless. If someone wants that, they can use their browser’s autofill for universal support. It’s much more common to want to remain logged in – and with “remember me”’s inscrutable lifetime (this session? A month? Indefinitely?), people who really want to log out will do so anyways. Remove all checkboxes and make life simple for your users. – Ry- Jul 14 '14 at 5:50
1

I can explain this to you by taking few examples

First is that you have allowed "keep me signed in" on your website, so there are chances of unauthorized access if the user computer gets hijacked or is in hands of an unauthorized person. A malicious person will be able to get every information residing on the account. However, there are least chances that the the person will be able to do any malicious activity such doing a transaction or changing the password and or email. These require an user to enter the current password.

Second case is that you have enabled 'Remember Email.' The user is comparatively more secure than in the previous case, chances are low that there will be an unauthorized access to the account. However, there is one little possibility of losing the account if there is any malware or say keylogger residing on the computer. The user will lose the control over the account, but it happens mostly in the case of targeted attacks.

In my opinion allowing 'Remember Email' is a better option than allowing 'Keep me Signed In.'

1

Debatable really. For me, I'd prefer the system to not remember the email/username, as I use a password manager that will pre-fill both the username and password. For a secure system you really need the user to uphold their end of the bargain in making their use of the system as secure as possible - which means either using a password manager or remembering a strong password. In the case of the latter, asking a user to re-enter their email address is trivial compared to the strong password.

Also, there may be a privacy issue with remember me functionality in the case that the email address is stored in plain text in the cookie. This cookie will be sent with every request to the domain (even for image files or pages that are accessible without login) and they may end up in server logs. Yes the user will have agreed for the system to remember their email address, but they may not realise that their email is being recoded in this way. Also, this will be stored in plain text on the client-side without the knowledge of the user. A more secure way would be to generate a secure ID for the email address server side and use this token to lookup the email address.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.