Re:Don’t Get Clever with Login Forms
by erichurkman on Friday February 15, 2019 @03:03PM
(#19174213)
> I thought the best practice was to make it unclear whether an email or username is in the system
It's useless obfuscation. 99% of systems that tell you "if you entered a valid username, we'll email you a password reset link" also don't allow duplicate accounts by email. Try to register a duplicate on their sign up page and they will tell you "this email address is already in use."
Useless "security" obfuscation and creates a terrible user experience trying to reset passwords.
Re:Don’t Get Clever with Login Forms
by hombre_fatal on Friday February 15, 2019 @02:31PM
(#19173954)
It doesn't change anything. If the email doesn't exist, you can always redirect to the password form.
If the user is confused about their credentials, they'll have to use the "I forgot" system in both cases.
I saw it on Expensify yesterday
Doesn't this break a best practice? If you input an email address it tells you whethere there IS or ISN'T a user, and if there IS it asks you for their password.
I thought the best practice was to make it unclear whether an email or username is in the system, which would make this a huge regression