States of Login

In the 60’s television show, Get Smart, the opening credits have the lead character, secret agent Maxwell Smart, entering the his agency’s headquarters. He progresses through a series of doors, unlocking each to get deeper into the secure facility. This is similar to how many login procedures currently work.

In my recent post, The Sign-in Travesty, one reader, Ron, talked about his frustration with Amazon.com’s frequent login requests. It’s not unusual for a user, when shopping on Amazon, to need to sign in even though the site has clearly demonstrated they are aware of the user’s identity.

One thing Ron said really jumped out at me:

… the user is either signed in or logged out, there’s nothing in between…

This is a desirable way to think of Amazon’s security. Unfortunately, it doesn’t match how the site works. It works more like the secret headquarters where Maxwell Smart works.

On Amazon (and other sites), there are multiple levels of security, each intended to protect the user from an unintentional breach or fraudulent use of their private information. The user proceeds through each level, as necessary.

At first glance, there are 3 levels of security:

Level 0: Amazon doesn’t know who you are (no cookie).
Level 1: Amazon knows you from a cookie. It’s how they know what books to recommend, what credit card use for 1-click.
Level 2: Amazon wants to reveal something that only you should know, such as your address or your shipping history.

The designers at Amazon have cleverly created more than a either-you’re-signed-in-or-you’re-logged-out perspective.

If looking to simplify the design, one could ask, “Why not combine level 1 with level 2?” Simplifying is always good, but there’s information you want to protect and there’s information that Amazon deems is harmless if someone other than you boots up your machine and visits their site. The separation in the two levels helps Amazon keep the user experience feeling personal, while preventing accidental privacy violations.

However, this more sophisticated model comes with a price. We can see this in the normal interaction of the site.

A user brings up the site and is greeted with their personalized banner.

The personalized banner Amazon uses for Level 1.

Because the site knows who the user is, it appears to the user that Amazon has logged them in, much like Ron suggested. Let’s say our user wants to check the status of an order. Amazon thinks this information is more private, so now it asks for a password.

The Amazon Sign-in page

This is where Amazon gets itself into trouble. The sign-in page doesn’t explain why the site suddenly displays amnesia, even though it knew the user a second ago. Out of nowhere, it requests the user id and password.

We’ve observed this sudden request startles users. A simple solution could be to provide explanatory text (or a link to explanatory text) telling the user the site is about to reveal personal information and wants to ensure it’s really the user at the keyboard. Giving users a reason for the sudden sign-in would improve the situation.

This is similar to another problem users frequently experience on Amazon: the disappearing stored credit cards. Many Amazon users opt to have the site remember their credit card information from one purchase to the next. It speeds up the purchase process and increases customer loyalty.

However, Amazon occasionally experiences more amnesia as it spontaneously seems to forget the stored credit card info. One instance is when you try to buy a gift certificate. In this case, Amazon only displays their “Pay with new card” functionality, pretending no information has been retained at all. To the user, all their stored information has mysteriously vanished.

Buying a gift certificate forgets stored credit card information

What Amazon doesn’t say is why they do this. It’s for the user’s protection. A common trick used by the evil individuals who steal user names and passwords is to quickly buy a gift certificate, which is basically like printing money using the users credit card. So, to protect the user, Amazon makes them re-identify themselves by having them re-enter the credit card information.

Again, the problem isn’t Amazon’s sensitivity to the user’s security — that’s a good thing. It’s the missing information about why the user’s information has temporarily disappeared. In essence, this is Level 3 security — Amazon wants to ensure the user’s site access information hasn’t been stolen. But, like Level 2, the user doesn’t have a model of its existence.

Multiple levels of security are great. However, designers need to learn ways to explain these more complex models, so users don’t panic when they encounter the security measures. Sophisticated security models are not intuitive for most users, so training is a required part of the interface design.