Summary first, as i think this post got a slightly exhaustive, …..
A good user-name/forgot-password design has:
1) Email address as user-name.
2) Allow user-name/email address in the forgot-password section, if 1) is not implemented.
Now if you have time to read this slightly exhaustive stuff, thanks and go ahead….
Today i got some leisure time, so i planned to update few of my blogs, delicious and other fancy sites which i have registered with but forget about them very soon. And to my surprise, i hardly remember a password and to add to it, i neither remember the user-names. Unfortunately i deleted the registration-success mails, which almost every website these days send. I found myself absolutely strangled. Then, like every user, i went to the FORGOT-PASSWORD section. This is where the story beings.
Some of the sites ask you either your user-name/email-address to be entered there. But some ask only user-name. The problem with the latter design is that, what if i forget the user-name also. If the user is asked to register with a user-name for each site, he may end up with 15-20 distinct user-names by the time he registers with say 50 sites, satya_123, satya_capy, satya_ruby….it gets much worse like satya_ruby_satya….man i hate this. These are impossible to remember, unless he has nothing else to remember.
So, i followed some of the sites registration procedure, and i realized that, some of the sites take the email address itself as user-name. As almost every web-user has an email address, it would not cost extra bytes in the users memory to remember the user-name for this website. All he has to remember is his SINGLE_EMAIL_ADDRESS. Don’t u think this is a good idea…..letting the users email address itself be his user-name.
If u already have your site up and running without this feature, then go with this little nice tweak to the forgot-password feature to …..allow the user to enter either the email address(entered while registration) or his user-name. As the password+user-name / link_to_reset is sent to his private email, we can ensure integrity.
This tweak in forgot-password is implemented in WORD-PRESS. There are a plenty others which implement this too. The advantage is that, if i actually forgot both user-name and password for the account, but im sure that i registered with a particular email address of mine. So in the forgot section, i just put-up my email, and it send me a reset link. PERFECT.
Yes there are other options like social-id , but it involves some pprogramming and integration, api calls and stuff. IF you dont have time to do this high-level stuff, then what i advocated above should do it for you.