I think I have the perfect solution for you, depending on the innerworkings of your system.  If you want give me a call on 07712255379 and I'll explain what I have in mind.

regards,

Denis
www.naxtech.com

I'm sure you will receive some helpful responses from other users here, but from a security point-of-view, you may want to keep the separation.  You shouldn't really be asking for un-necessary information unless you can justify why and how it will be used (Data Protection Act).  It might be that registration is very straightforward, but these things tend to attract the "we also need to know" questions.

If X, Y and Z have real benefits to the user, they will register.  If you need additional user information for those, it makes sense to protect that in some way.  For example if registering lets the user recall previous transactions or data submitted.

It's best not to force strict user authentication on the simplest things... but keep that for more sensitive data.

Perhaps allow users to:

• submit their email address for updates/alerts and require them to validate the email;
• complete actions A, B and C via standard web form regardless if unregistered, but optionally allow them to 'register' at the same time; and
• complete actions A, B and C as well as X, Y and Z via standard web forms if they are registered, via a user account area, and subscribe to email alerts without further validation.

All forms that contain personal or sensitive data should be hosted on, and submitted to, a secure server (https).  Then ensure you keep the data safe wherever it is stored, displayed or copied to.  Check your DPA registration and site's privacy statement.  If you work in a regulated area, consider those requirements as well.

Colin Watson
Technical Director
Watson Hall Ltd for website security

It's an interesting question! Without understanding the actual functionallity of the various functions it is a little tricky, but I would be thinking along the following lines:

1) Is there a meaningful subset of my target user community that would only need to ever use functions A B C? If there is then I would definately make them available only after registration. (Thinking about your success criteria here).

2) Are the functions A B C trivial in the sense that they could be used as a teaser to encourage people to want functions X Y Z? If so then I would design them to be marketing pages with a very strong call to action for people to sign up.

My feeling (based on very limited info) is that I would put all the options into a signed-up members only section and then make sure that the sign up process was not too lengthy (to minimse abandoned sign-ups). I would then make sure that I promoted the account management functions heavily to make sure that I drove people to sign up. 

Bottom line - if success is defined as number of people signing up then I can see no advantage in giving users a viable option to make use of the site without signing up.

Not sure if that helps, but it is another perspective!

Kind Regards

Ed Stivala

n3wmedia.com