{"id":22747,"date":"2025-11-08T01:25:00","date_gmt":"2025-11-08T01:25:00","guid":{"rendered":"https:\/\/pokecon.jp\/job\/?p=22747"},"modified":"2025-11-08T01:25:00","modified_gmt":"2025-11-08T01:25:00","slug":"en-leveraging-user-frustration-for-increased-security-how-we-drove-passkey-adoption-after-password-reset-jp-%e3%83%a6%e3%83%bc%e3%82%b6%e3%83%bc%e3%81%ae%e4%b8%8d%e6%ba%80%e3%82%92%e6%a9%9f","status":"publish","type":"post","link":"https:\/\/pokecon.jp\/job\/22747\/","title":{"rendered":"[EN] Leveraging User Frustration for Increased Security: How We Drove Passkey Adoption After Password Reset | [JP] \u30e6\u30fc\u30b6\u30fc\u306e\u4e0d\u6e80\u3092\u6a5f\u4f1a\u306b\u5909\u3048\u308b\uff1a\u30d1\u30b9\u30ef\u30fc\u30c9\u30ea\u30bb\u30c3\u30c8\u76f4\u5f8c\u306e\u30d1\u30b9\u30ad\u30fc\u5c0e\u5165\u3067\u63a1\u7528\u7387\u304c\u5927\u5e45\u30a2\u30c3\u30d7"},"content":{"rendered":"\n<\/p>\n
\n

\u65e5\u672c\u8a9e\u306e\u6587\u7ae0\u306f\u5f8c\u534a\u3067\u3059\u3002<\/a><\/p>\n

Hello! I\u2019m Teysir, a Frontend Engineer in the Apps unit here at Nulab. I recently had the privilege of leading a project focused on modernizing and improving our password recovery functionality. This initiative was crucial for delivering a more secure and streamlined experience for our users.<\/p>\n

The friction of a forgotten password is a universal pain point in the user journey. Our recent project was designed not only to modernize this frustrating flow but also to use this moment of account recovery as a strategic opportunity to drive user security through passkey adoption.<\/p>\n

English version<\/h2>\n

Modernizing Account Recovery<\/h3>\n

We in the project team first set out to refactor and modernize our entire password reset experience. The core objective of the project was twofold: for end users who forgot their password, we needed a newly designed solution that delivers streamlined and secure experience and promotes passwordless access.<\/p>\n

Technically, the project involved refactoring the existing implementation and migrating to the latest React and Next.js, and modernizing the password reset page\u2019s functionality and design. As a result, we achieved a modern and highly maintainable password recovery function that ensures consistent UI\/UX across all authentication features.<\/p>\n

Promoting Passkeys at the Optimal Moment<\/h3>\n

While refactoring the front end was one challenge, the even bigger question was deciding the optimal point in the flow to introduce passkey creation.
We in the project team considered three main approaches:<\/p>\n

    \n
  1. Option A (Replace Password Reset): Allowing users to create a passkey instead of setting a new password. This was rejected due to concerns about creating UX inconsistency, as other flows require knowing the current password.<\/li>\n
  2. Option B (Passive promotion): Executing the standard password reset and only promoting the benefits of passkeys on the view, without allowing direct creation. We were concerned this would have limited effectiveness in driving specific registration action.<\/li>\n
  3. Option C (Strategic enrollment): First, complete the mandatory password reset, and then immediately add an optional screen where the user can create a passkey.<\/li>\n<\/ol>\n

    FIDO Alliance Design Guideline<\/h4>\n

    We ultimately adopted Option C, based on the FIDO Alliance design guideline \u201cCreate Passkey After Account Recovery Due To Forgotten Password<\/a>\u201d.<\/p>\n

    According to the UX knowledge shared in the guidelines, when users are in the midst of account management and experiencing the friction of a password reset, proposing passkey creation feels like a relevant feature that enhances the task, rather than an unnecessary interruption.<\/p>\n

    Through this flow, the project team secured the following points:<\/p>\n

    \"PasswordPassword recovery flow<\/span><\/p>\n