One of not very interesting design decisions we made when we rebuilt the site was to store only hashed passwords. For those of you that don't live in the technical world, that means we apply an algorithm (formula) to your password and we store the result. When you login, you enter your password and we apply the same algorithm and test the result against the stored value - if they match, you're in! The upside is that even if you're using a really bad password like 'password' we don't see it, and if our server was hacked they would not get your password either.
Sounds good, right? More security, reasonably pain free to the visitor. The downside is when you forget your password. If we were storing your password in clear text, we could just email it to you. Since we don't know your password, we have you enter a secret question and answer when you sign up - but what happens if you don't remember the answer? And there's our current pain point, based on the current form we show you:
Most people get frustrated because they don't remember the answer and miss the 'I forgot my answer' button at the bottom. If you click that we send you a new password via email, when you log back in you can change it. Works fine....if you understand what we want you to do!
It's on the list for our sprint (batch of work) to fix, or at least do differently. Good user interface matters is an obvious statement, not always so easy to know what is a good UI. We watch and listen a lot, and that's where we find places that need work. On an average week perhaps a dozen people use the form, and maybe 1-2 of them get frustrated, and that's more than we'd like for something that should be routine.
