fedemolina

Marketing Lead @ Decentraland

Federico Molina

Intuitive design, interface, and simple layouts are key to keeping people on your site. Is your login experience driving users away?



<div class="alert alert-info alert-icon">
  <i class="icon-budicon-500"></i>
  <strong>Forrester Consulting analysis determines that using Auth0 can yield a 548% ROI and $3.7M in identity-related savings. Read the full report: <a href="https://resources.auth0.com/forrester-tei-research-case-study/">Total Economic Impact of Auth0</a>.</strong>
</div>

---
About [60% of users have admitted to reusing passwords](https://www.passwordboss.com/password-habits-survey-part-1/) to avoid having to remember multiple sign ins. Logging in to a site is so annoying for most people they're willing to compromise their security to make it easier. 

Your company's login is the first impression of its services. For customers, the login experience is a proxy for how your product and customer service will fare later. If your login is inconvenient, unclear, takes too long, sticky or clunky, you could be losing customers who will never come back. 

Below are some examples of counterintuitive logins as well as solutions to ease the login process for your customers.

## The Login Form Should Be Easy to Navigate

Users have to pick one login pathway from a list of 34 options just to enter the website for the health care solution provider McKesson. This company offers 34 different login pages on 34 separate sites, when it could just be one easy login that funnels you to the right place.

A login like this is daunting for customers.

![Bad Login UX Example](https://images.ctfassets.net/23aumh6u8s0i/2AwMN3xXgxAOYpebUAnK9Y/03307fdec4e419cfd30332b6cd2b4078/bad-login-example)

Having too many steps to your login process will turn customers off and they might move on to a competing site.

Loyalty programs, in particular, are notorious for having too many steps required for logging in. On the first page for many of these sites, customers have to input their username and passwords. From there they may have to answer security questions or log in again through their bank, credit card, or other partners to be authenticated.

Logging in should be as easy as entering a password or, ideally, clicking a button. There shouldn't be too many steps and there also shouldn't be winding pathways to get to the login page itself. 

Auth0 offers [Passwordless login](https://auth0.com/passwordless) which is both secure and fast. It uses email or SMS to authenticate customers and moves them quickly into the site. By clicking on a magic link, users can fly past the login panel to enter the site. It's more intuitive and secure than a wall of login options all leading to different sites. 


## Customers Will Leave if Logging On Requires Too Many Steps

When you try to log into [Starwood Preferred Guests' Guest Loyalty Program](http://www.starwoodhotels.com/preferredguest/index.html?language=en_US) via multiple devices you have to answer annoying security questions.

![SPG Loyalty Program Login](https://images.ctfassets.net/23aumh6u8s0i/2nuPyD6Lq1jxBwL1gkugPt/6888a61b9f24f867f731bbb2000b3816/spg-login)

![SPG Loyalty Program login with many security questions](https://images.ctfassets.net/23aumh6u8s0i/Bu9k8zg8JZgT9AB5dbZ3f/ccb5f7d36bf308c009c695a60beada47/spg-security-questions)

Pages that take longer than three seconds to load can result in a [7% reduction in conversions](https://blog.kissmetrics.com/loading-time/). That's just loading. When customers have to spend longer than a few seconds logging in, there's a good chance they'll leave too. Security questions like Starwood's can frustrate customers so much they bounce from the page.

Banks and credit cards often have lengthy login processes in order to authenticate users. They'll also ask security questions or require extra passwords. And while security is important for these services, there are more customer-centric ways of providing a secure login and digestible user interface. 

[Single Sign On](https://auth0.com/blog/what-is-and-how-does-single-sign-on-work/) (SSO), for example, automatically links logins through federated identity so users can log in from multiple devices and across different domains. Federated identity provides a single access pathway across multiple systems through a variety of enterprise sources. SSO authenticates and authorizes users so they can enter the site quickly without having to deal with a series of security questions while still keeping the process safe from hacking.

## Unclear Signage Confuses and Frustrates Users

It's not clear where the login is for SSLPrivateProxy, shown below. Is it “Getting Started,” “Login,” or “Register”? Any of these, which are all located in the upper left-hand corner, could be entry points for the site. 

![SSL Private Proxy shows an unclear login experience](https://images.ctfassets.net/23aumh6u8s0i/34niRJ0OtvYQ9RVvMZtL3t/d12960fcbee23c39bdf2d978a4f0c250/sslprivateproxy-unclear-login)

![SSL Private Proxy showing login for clients](https://images.ctfassets.net/23aumh6u8s0i/77Ar74cytGPKbyzociMzM/5ffb8005512318ee9b602e8abb32f8aa/sslprivateproxy-login-for-clients)

Counterintuitive design for login panels can frustrate customers and waste their time. The login panel should be front and center on the landing page. Or, if not center, at least easily accessible as soon as the customer enters the website. 

Customers have to spend an extra second deciding which one to click on. And even from there, instead of a small [login widget](https://auth0.com/how-it-works), which hovers upon a click over the landing page, customers are taken to a completely new page to log in. This login wastes time and might even prompt some customers to leave or avoid using the site.

## Easy Login Keeps Customers Happy and Boosts Company Growth

Login is only the gateway for your website, it isn't even your product. And, yet, when the login design, interface, and experience is complicated or annoying, customers have to spend time carefully considering how they will sign in. This doesn't count the actual logging in which may include trying multiple passwords, password resets, or new registration. 

Clean and easy login can not only boost the user's experience, but it can lead to drive MRR. Customers love [social login](https://auth0.com/learn/social-login/) so much it's even [driving growth and conversion rates](https://auth0.com/blog/how-to-use-social-login-to-drive-your-apps-growth/) for many companies who have employed it. One company reported that [social logins lead to a 40-60% increase](https://www.quora.com/What-impact-does-social-login-have-on-conversion-rates) in conversion rates for them. Some said they saw a whopping 130% increase in conversions due to social login.

Social login has the dual effect of making your site easier to enter and use while also making the whole design look cleaner. Clean design actively invites customers in, making them more likely to spend time on your site and trust your company's products.

## Aside: Auth0 Login Widget

Our Lock widget is a beautifully designed, all-in-one, embeddable login box for your apps. It provides sign up, sign in, password reset, and other features that are ready to go. The widget’s styles can be easily customized to line up with your brand, and you can use one of our pre-made themes to help. Unlock the power of a good login experience with Auth0 Lock. Try our live demo in the [Auth0 Lock](https://auth0.com/lock) page.

![Auth0 Login Widget"](https://images.ctfassets.net/23aumh6u8s0i/6JbvTf3oNiN8D2OyFpUoka/ddbf2f9d2741964186381c240aca0c44/what-is-social-login-1)

## Focusing on Your User's Experience Will Keep Them Coming Back

Login is the gateway to your whole website and your product beyond that. If customers feel like there are any roadblocks to them entering your website, they'll move on to another. 

There shouldn't be any obstacles for customers to enter your site beyond basic authentication. They shouldn't even have to do more than press a button to be allowed in.

By making login easier for customers with passwordless login, social login, or SSO, companies can actually boost business overall. It's a win all around.



Bad Login Experience Can Drive Customers Away

diegopoza

System Engineer, geek, foodie, technology lover, speaker.

Sr Manager, Developer Advocacy

Diego Poza

Making security your best Customer Retention Hack



So much of your energy after launching a product goes into marketing. You want to see your product in the hands of as many customers as possible, and you want it done quickly. However, if you want to see real growth, the energy you spend on acquiring new customers should always be outpaced by the energy you spend on retaining customers.

Acquiring a new customer can cost anywhere from[ 5 to 25 times](https://hbr.org/2014/10/the-value-of-keeping-the-right-customers/) as much as retaining an existing one, and a simple 5% increase in customer retention can lead to a profit increase of [25% to 95%](https://hbr.org/2014/10/the-value-of-keeping-the-right-customers/). Fortunately, this is common knowledge at this point, and most companies prioritize retention.

<include src="TweetQuote" quoteText="A simple 5% increase in customer retention can lead to a profit increase of 25% to 95%"/>

Unfortunately, most companies only focus their retention strategies around building a more engaging user experience, and fail to give enough attention to the most important part of customer retention: security.

## Why Security Is The Best Customer Retention Hack

Customer retention, essentially, is a combination of loyalty and trust. If you give customers an enjoyable, valuable experience, you can gain their loyalty. Gaining their trust, however, requires you to protect them. This is particularly relevant in today’s digital age, where high-profile hacks seem to happen every day.

One study found that [75%](http://www.safenet-inc.com/resources/data-protection/customer-loyalty-data-breaches-infographic/) of consumers believe companies don’t take the protection of their data seriously enough. The same study found that 64% of customers say they are unlikely to ever do business again with a company if their private data is breached. It’s hard to find another event that could immediately strip 65% of your customer base, regardless of how engaging your product is.

The only thing between your company and this plummet is your security protocol, and so it better be good. With this in mind, we took 4 of the most common retention strategies and adapted them for security.

## 1. Use Push Notifications To Engage Customers—Just Don’t Accidentally Steal Their Data

In 2015, users who opted into push notifications for a given app showed an average [171% increase](http://info.localytics.com/blog/2015-the-year-that-push-notifications-grew-up) in engagement compared to users who opted out. [Appcues](http://www.appcues.com/), a service that builds in-app experiences for non-programmers, observes that e-commerce apps, in particular, can experience boosts in engagement of [278% via push notifications](http://www.appcues.com/blog/why-feature-blindness-is-killing-your-apps-retention-and-how-you-can-fix-it/).

The New York Times recently embraced push notifications by building an 11 person team completely dedicated to crafting and scheduling push notifications for their readership. Andrew Phelps, the team's leader, said that it [allows readers to](http://digiday.com/publishers/inside-new-york-times-new-push-notifications-team/) “treat their lock screen like an inbox.”

![Push Notifications](https://images.ctfassets.net/23aumh6u8s0i/62Fb1XB2lqRog3vHJ3aJMi/06b865a14a4e40f584b4ce632df9cef3/push-notifications)
_source: [Medium](https://cdn-images-1.medium.com/max/800/1*EbQjVSgYsFfL3vcy42n8AA.jpeg)_

It makes sense. If readers aren’t looking at your app, it doesn’t matter what you update, they won’t see it. What is less discussed is the potential security risk of misused push notifications.

### Why it’s a security risk

Microsoft released an iOS version of their Outlook app in 2015 that featured push notifications. However, developer and security blogger René Winkelmeyer discovered that the app was collecting an invasive amount of data. For example, the app required access to your Google Drive, DropBox, and OneDrive accounts. It also [stored your mail and server credentials](https://blog.winkelmeyer.com/2015/01/warning-microsofts-outlook-app-for-ios-breaks-your-company-security/), constantly scanning your server and account.

This means that even if you turned the app off, Microsoft’s central service would check your email and send push notifications to you. This also means that all of your personal information and credentials would be stored on Microsoft’s cloud.

Issues of privacy aside, collecting data you don’t need increases your liability without any benefit to you. The more of a customer’s data you hold, the greater the damage will be should you ever experience a breach. Look at TJX.

<include src="TweetQuote" quoteText="The more of a customer’s data you hold, the greater the damage will be should you ever experience a breach."/>

In 2005, the retailer was the victim of one of the [largest cyber attacks in history](http://www.wired.com/2007/10/tjx-failed-to-n/), resulting in the theft of thousands of credit card numbers. In the words of Canadian privacy commissioner [Jennifer Stoddart](https://www.washingtonpost.com/business/technology/), “The company collected too much personal information, kept it too long and relied on weak encryption to protect it.”

As [many critics](http://searchsecurity.techtarget.com/magazineContent/Companies-Collecting-Too-Much-Customer-Data-Increase-Exposure) would go on to point out, keeping data on your customers that is not absolutely essential to your transaction just makes things worse for you in the event of a breach.

### How to stay safe

This one has a relatively simple solution, and it’s based around the idea that data is a [toxic asset](https://www.schneier.com/blog/archives/2016/03/data_is_a_toxic.html). By toxic, we mean that storing user data makes you vulnerable. In the last year, data breaches at the [IRS](http://fortune.com/2016/02/10/irs-hack-refunds/), [CIA](http://motherboard.vice.com/read/teen-who-hacked-cia-email-is-back-to-prank-us-spy-chief), [OPM](http://www.nbcnews.com/tech/security/opm-hack-government-finally-starts-notifying-21-5-million-victims-n437126), and the slightly less stately [Ashley Madison](http://www.wired.com/2015/08/check-loved-one-exposed-ashley-madison-hack/) have proven this.

Combating it comes in two parts. One comes as a recommendation from the Center of Democracy and Technology: only collect [vitally necessary data](https://cdt.org/insight/data-in-the-on-demand-economy-privacy-and-security-in-government-data-mandates/), and never store it indefinitely. If you don’t need socials, don’t collect them. If a user deactivates their account, either delete the data or store it on an offline drive.

The second part is to use high-level authentication. For example, by using the Auth0 dashboard or a GitHub integration, you can use [Auth0’s Rules](https://auth0.com/docs/rules) to authenticate users according to many protocols, based on a [variety of attributes](https://auth0.com/docs/rules/context), including their name, user agent, POST request, IP, and many others. All of this can be done with a few lines of code, allowing you to easily decide who can access what data during the authentication process.

## 2. Social Logins Work Wonders, If You Provide A Back-Up Plan

If you want to [skyrocket your conversion rates](https://auth0.com/blog/2015/12/16/how-to-use-social-login-to-drive-your-apps-growth/) and increase retention, you need to integrate social logins. Your signup conversions can jump 20%, and your registration rates can soar to a 50% increase.

The reasoning behind this is clear. When it comes to product development, streamlining your customer’s experience, without losing your robustness, is the name of the game. You want your product to be intuitive. Social login does this in two ways.

First, it makes logging into the app more convenient. Instead of adding another account to the mess of usernames and passwords they already manage, you let your customers login with an account they already have. Easy.

![Social Logins works wonders](https://images.ctfassets.net/23aumh6u8s0i/1wIZ7YBya4XwLVtqpkZ6s0/d62b5879ec1aed6d73683238e76f9ac9/social-logins)

Along with this, by connecting your app to social media, you’ve made it that much easier for your customers to share your product via social media. For example, the average media site saw a [300% increase](http://blog.hubspot.com/blog/tabid/6307/bid/12393/Facebook-s-Like-Button-Turns-One-Usage-Data.aspx) in traffic after integrating with Facebook.

Increasing conversion rates and making your customers’ lives easier is a hard prospect to pass up. Even Mailchimp, who famously penned an anti-social login article, [posted said article](https://blog.mailchimp.com/social-login-buttons-arent-worth-it/) on their blog—which supports social login.

### Why it’s a security risk

In 2013, Facebook locked thousands of users out of their accounts and required that they submit [proof of a government ID](http://www.theblaze.com/stories/2013/10/29/absurd-facebook-requesting-government-id-to-unlock-accounts-again/) for processing. Companies whose apps relied on Facebook social logins were subsequently [locking their customers out](https://hbr.org/2013/12/mitigating-the-risks-of-social-login/) for days.

While being locked out of Facebook isn’t life or death (unless you built your company on Facebook, as many do), being locked out of your work account, or being locked out of a service your company requires, can cause downtime, costing you money and customers.

 In Fortune 1000 companies, for example, the cost of application failure is between [$500,000 and $1 million per hour](http://www.reuters.com/article/idUSnMKWyC4T8a+1d4+MKW20150204).

If you rely entirely on the stability of someone else’s platform, you’re rolling the dice everyday as to whether or not your customers will be able to access your service.

### How to stay safe

Redundancy is key in security. At Auth0, we allow you to integrate social logins from over[ 30 different platforms](https://auth0.com/learn/social-login/), including Facebook, Twitter, LinkedIn, PayPal, Wordpress, and many more. If you connect your app to even 3 of these platforms, all 3 would have to simultaneously crash to lock your customer out.

![Auth0 Lock](https://images.ctfassets.net/23aumh6u8s0i/2NmMY4oO6VPzDuUM1Mn7Z6/78418f2bf9cf7786a9b6daabba1f7047/auth0-lock)


[Auth0 Lock](https://auth0.com/lock), a plug-and-play login field you can easily embed in your app to incorporate as many of our supported social platforms as you’d like. From your Auth0 dashboard, simply navigate to the “Social” category (it’s under “Connections”), and click toggle on/off whichever platforms you’d like.

![Social Connections](https://images.ctfassets.net/23aumh6u8s0i/1XFjBqR6A9QNhvsUcjwjis/e363bfb1e17faad8f0d0baf4f0818418/social-connections)

Incorporating a system of redundancies in this way doesn’t just increase the number of services your customers can authenticate with, it increases the number of platforms they can easily share your product on.

## 3.  Email Is A Corner Stone of Retention, And a Huge Security Risk

If you read any list of customer retention tactics, one of the first suggestions will always be to use a service like [Customer.io](https://customer.io/) to send targeted and automated messages to your customers at different stages in their lifecycle.

For example, you can have emails [automatically sent](https://customer.io/docs/transactional-email.html) to customers when they register, when they finish onboarding, and when their usage data slows. In addition, you can personalize how you send the message, for example sending at the [time of day](https://customer.io/docs/welcome-email.html) most convenient to your customer.

This is great advice. Personalized emails have [6x higher](http://marketingland.com/study-70-brands-personalizing-emails-missing-higher-transaction-rates-revenue-73241) open rate, and [81% of users](http://www.emarketer.com/Article/Personalization-Sees-Payoffs-Marketing-Emails/1010563) say they’re more likely to make a purchase from a company that sends personalized email. The beauty retailer Sephora, worth a little over [$2.2 billion](https://en.wikipedia.org/wiki/Sephora), bases its digital marketing campaign around targeting so specific that it takes into account the customer’s [skin tone](https://blogs.adobe.com/digitalmarketing/digital-marketing/personalization-success-sephora-leading-brands-thrive/) before sending an email.

However, using email without regard for security is a big gamble—one that could break your company.

### Why it’s a security risk

Phishing scams—from old-fashioned [Nigerian prince scams](http://www.pcworld.com/article/192664/the_story_behind_the_nigerian_phishing_scam.html) to more modern “[artisanal spam](https://auth0.com/blog/2016/02/29/the-new-trend-of-artisanal-spam/)”—are a cultural staple of the internet at this point. Everyone has received a dodgy email or seen a questionable pop-up asking them to “Download this urgent update!!!” and most of us have the wherewithal to ignore them.

You would think that in today’s tech-savvy world, government agencies would be too sophisticated to fall for these ploys. You’d be wrong.

In the last year, the director of the CIA, the [US Director of National Intelligence](http://motherboard.vice.com/read/teen-who-hacked-cia-email-is-back-to-prank-us-spy-chief), and President Obama’s senior advisor on science and technology have all fallen victim to phishing attacks, allegedly led by the same group of high school students.

John Holdren, senior advisor on science and tech, had his information stolen when attackers [spoofed his email address](http://motherboard.vice.com/read/teens-who-hacked-cia-director-also-hit-white-house-official) and asked his wife Cheryl for the password to their joint Xfinity account. From there, they were able to infiltrate other private accounts, eventually forwarding all incoming calls to the Holden’s home to the Free Palestine Movement.

The attack on CIA Director John Brennan featured a different type of social engineering. The hackers were able to [spoof their credentials](http://www.wired.com/2015/10/hacker-who-broke-into-cia-director-john-brennan-email-tells-how-he-did-it/) with Verizon, pretending to be company employees to access Brennan’s personal data, which they used to reset his personal AOL email address’ password.

### How to stay safe

In all of these examples, the attackers were focused on stealing the victims’ passwords. If you did away with passwords altogether, you’d make these attacks quite a bit more difficult.

Auth0’s [Passwordless Login](https://auth0.com/passwordless) does just this. Instead of typing in their credentials, users [click a magic link](https://auth0.com/docs/connections/passwordless/spa-email-link) that is sent to them via email.

![Passwordless Magic Link Flow](https://images.ctfassets.net/23aumh6u8s0i/xXl3QCBWt9vYhXwSovCyv/9f75be9d2291a0e624a86bb35522c01b/passwordless-diagram)

While this severely limits an attacker's capability for accessing your app with a legitimate user’s credentials, it does not entirely prevent attackers from spoofing an email from you to gain a user’s credentials for other accounts, like their email address.

In order to prevent this, you need to do two things. Educate your users on staying aware of phishing attacks, and incorporate [DMARC, SPF, and DKIM](https://auth0.com/docs/connections/passwordless/faq) functionality either through your own custom email provider, or an Auth0 supported service like[ SendGrid](https://sendgrid.com/). These protocols, in combination, analyze an email’s headers and signatures to make sure that it is being sent from a legitimate domain, and that it has not been tampered with by a third party.

And if you’re trying to communicate something that needs very extreme security and privacy, consider using our new open-source [Sharelock](https://sharelock.io/). It allows you to share a secret exclusively with whoever you’d like via email or any other social platform. The software uses high-level encryption, and never stores your messages on any server. They are transmitted in the URL itself. Also, because it’s open-source, you can feel free to deploy it to your own server as you’d like.

![Sharelock.io](https://images.ctfassets.net/23aumh6u8s0i/7fwHJNUG3OoKmpUzLYOjIR/a8f6d282b90b86aa537208bf96c72a86/sharelock)


## The More You Do, The More You Need To Worry About Security

Every developer understands feature creep. As Steli Efti, founder of [Close.io](http://close.io/), points out, developing unnecessary add-ons [will give you](http://blog.close.io/lean-sales-customer-development-pitfalls-that-will-sink-your-startup) a “haphazard product bloated by feature creep” full of “features that no one cares about.”

The risk developers discuss less is the relationship between extra features and vulnerability. Incorporating an email system, video content, social logins, or push notifications, if done right, will give you a dramatic boost in customer retention. Each addition, however, also increases the number of things you have to secure.

Failing to secure your products is the surest way to sink any retention plan. It doesn’t matter how engaging your content is, if you can’t protect your data, you will not be able to keep customers.


"customer-retention"