Frustrated w Reset Password Process

[Birdsafe]

I can't count the number of phone calls and emails I've received over the past couple of months from customers who can't reset their passwords -- every time I use the support chat to get help on the matter, support seems dumbfounded -- asking me what password the customer was trying to use -- I don't know -- whenever I try to reset the password, half the time it doesn't work. Then after a customer tries more than twice to reset it they get presented with the even-more frustrating Captcha process of selecting the idiot pictures with cars or signs in them -- I thought the "I'm not a Robot" would be an improvement there -- not so sure.

I used to allow guest checkout but stopped when I started using Recurring orders -- now I'm wondering if that was a mistake because every customer who was a guest now can't checkout without going through a tedious process where the end up tying me up on the phone for 20 minutes trying to explain what is wrong -- and I don't know. Somewhere I've seen mention of password must be at least 8 characters but nowhere does it tell customers that.

[bzeltzer]

I've heard the same sort of frustrations from a few customers but I allow guest checkout. Whenever I've tested it, I've found that everything works as it should. User error is definitely something that we have to try to work around. This message tells users about the password length issue. If you identify something that's broken or counterintuitive, I'd be interested in hearing about it.


CapturFiles-201708236_130818.jpg

[Birdsafe]

Thanks -- I would love to allow guest checkout but they say you cannot with the Recurring Orders module. I' not sure why customers are not seeing that message about password -- perhaps they have a popup blocker. I'm wondering if the minimum could be added to the create account page or reset password page where they enter a PW

[JoeBTI]

This is an overwhelming issue. We receive many calls and emails everyday with customers unable to reset their password. Some say they NEVER receive the email to reset the password and some say nothing happens when they click the emailed link. (And yes its usually within the 10 minute window)

Recently I've received complaints from customers saying that the password they've been using always is not working. I'm talking customers who order from us on a weekly basis.

Everything works fine every time I try to replicate the issue on my account.

There is something goofy going on.

[bzeltzer]

Birdsafe I don't think this is a regular pop-up so I'm fairly sure that it's not being blocked by a pop-up blocker. These days, those are just built into the browsers
JoeBTI I agree that it's complicated. One guess I have is this: My 3dcart emails don't send as quickly as emails from the rest of the universe. It's possible that the emails are queued by 3dcart's mail server and:

1. Sometimes by the time customers receive them the links have expired because it's past 10 minutes
2. Sometimes the customers try to reset the password more than once and when they actually receive an email, they're clicking on a link that's been superseded by a later link that they may or may not have received.
3. Sometimes they do dumb things like use caps without knowing or type in the wrong password both when they're resetting and afterwards

It could be a combination of these things and perhaps more. I doubt that the database's password fields are being corrupted. That said if some customers are using non-standard apostrophes or commas, it's possible. I've seen 3dcart database problems like that years ago. Unfortunately, without a lot of testing, no one can tell. If this thread grew, 3dcart would probably put the resources into it. Unfortunately, participation on these forums is a fraction of what it once was. I do think that the crappy mail server might be part of the issue. Poor database query performance could be another but that's unfounded speculation.

[kelly]

What is the actual time the password reset expires?

[Elimax]

We field numerous customer complaints in regards to PW reset. We allow guest checkout and that bypasses a lot of them, as we can simply reply that they don't have to be logged into their account to checkout. It's frustrating for them and for us. Certainly an area that could use a little investigation by 3d.

[GonzaloGil]

@Elimax what type of complaints are you getting? That they are not getting the email? or password requirements are too strict? We are always open to suggestions, maybe try the password reset option yourself with a customer account with your email, see how the process is and let us know what you think could work better. Some of the things like the expiration on the link are required for PCI compliance, but if there is anything else that can be improved let me know,

[kelly]

What is the actual time the password reset expires?

[GonzaloGil]

@kelly 24 hours

[Elimax]

I did it a couple of times with the customer and then myself, the frustration seemed to come in the delay of the password reset link. As I have no control or insight into the customers spam, rules, etc., I did not pursue, although when I did it myself the reset link took about 10 minutes to come thru. What is the expected time for that link to be sent from the 3d servers?

[GonzaloGil]

@Elimax the email is sent right away, however, it all depends on what happens on the way there. Some mail servers have greylisting so if its the first time they see an email from your domain they will reject it, knowing that the system will try again and spammers don't, this causes delays sometimes, but we have no control over that. If you have the password as "optional" and a customer places an order with the same email as their account on file, leaving the password blank, it will still let them place it...the latest checkout template in Core is setup in a way that the password field doesn't show up unless the customer clicks the checkbox to register which makes it a little bit more user friendly ...we've thought about the idea of converting orders that have an email on file but incorrect password as just "guest" orders, but, it could get confusing for the customer, as if they log in to their account, they won't see the order they just placed..

[kelly]

I just added this to system messages:

126

Reset Password

A link to reset your password was sent - takes between 5 and 10 minutes. It will be valid for 24 hours. Please check your junk mail if you do not receive an email.

127	Link Expired

The link to reset your password expired after 24 hours. Please, request a new link and try again. Please check your junk mail if you do not receive an email.