To autologin or not to autologin?

[dennisgorelik]

At PostJobFree we are sending out multiple emails.
For example, job search alertsThese emails have links, and these links allow us to track users

Comments

[yostrov]

Allow auto-login, but ask for password in case of any action with access to personal data.
For example, allow search, but not open profile.

[dennisgorelik]

What if job seeker wants to apply for a new job - should we allow job seeker to rely on autologin or should we require user to enter a password?

[yostrov]

Yes, if no changes in resume made.

[dennisgorelik]

Why do you think we should require explicit login if user wants to update their resume?

Even if resume was updated or wiped out - it's easy to re-post it again and fix the damage, right?

[yostrov]

You should require explicit login if user wants to see their resume. I may have 5 resumes on my account(s) I don't want anyone see it.
Profile may contain personal information about user, references and old employers.
If I've got a damage from a service, I may not use it again.

[dennisgorelik]

PostJobFree uses resume that user used to apply to the previous job - as a template for the new job application.
That's a convenience feature.
If we do not allow autologin-ed user to see that resume - we pretty much cripple that convenience feature.

By the way, why would you as a job seeker send personal information (references) to a stranger (new recruiter), but would not want recruiter who you already know (and sending emails to) to see the same personal information?

[yostrov]

I can send resume without review.

"already know" is not equal to trust.
I may not want to share current manager address with some recruiter, for example.