Revealing user names (As in "you are trying to log in as Luke") is usually considered a security issue, though.

This was my first thought as well. I thought it was bad when it just verified that you had used a correct username after attempting to log in, then I kept reading and saw the auto-complete combobox of usernames...

That combobox was baffling.

My first thought was: what about duplicate names?

Then it just gives you the available passwords as well. You select the right combination. Easy peasy.

I believe revealing whether or not an email address has an account is also considered a security issue.

Validation on registration form reveals this already.

Well-designed registration forms should not reveal this. Our registration forms provide the error "Email address or password is incorrect. Please try again." Further, forgotten password forms, etc. should also not reveal this.

Pssst... the registration form, not the login form. As in sorry, we cannot create you an account as your selected username has already been taken.

as a matter of fact, they don't strictly tell you who the person is with an email address... they just tell you that the email address is taken.

Yes, and in this case the designer made a (hopefully conscious) decision that usability was more important to the user than the information that an attacker would gain. These sorts of decisions are the hard part of building web applications; there's no right answer applicable to all situations, you have to use judgment and experience to gauge how to balance the competing needs of your users and your business.

Probably doesn't make much of a difference on those sites that have public profiles, though. They typically have the username in the URL anyway.

... and not to mention a user privacy violation.

How so? Please do elaborate.

(edit) In a context of a system that allows anyone to register new account, which appears to be what the linked article focuses on.

It's probably a minor issue, but if you can check for existing user names, you have a much easier time trying to find the matching password. Also, it could be a privacy issue (knowing user x is a customer of service y). Showing a photo as well...

Of course it depends on the context. On Hacker News all user names are visible anyway.

So for the Quora login form that determines whether someone's email address has already registered on the system... What's to stop me from: - looking at the source code, - finding the JavaScript call to the REST service that checks for an account - writing a script to loop through all well-known domains and usernames?

Tada! Instant email scraping tool.

Actually, I re-read the article just to make sure that I wasn't being too critical. I'm not. The author doesn't mention any security risks/benefits associated with the new login form designs.

It reminds me of the time when a former boss asked me to add authentication onto the company intranet. She wanted to know who is logging in and viewing private documents, but she didn't like typing in or remembering passwords so I could only ask users for their username and "trust" that they wouldn't type in someone else's username instead. For some (probably most) users, security isn't on the forefront of their mind, so they need to be reminded of it.

Here is another one I've experimented with: No passwords. You get a login key in the first email we send, or you can request a new email to log in.

Your email is the weakest link in a lot of password-based schemes anyways, but this approach is less secure and a bit confusing.

This is a great idea, but is it hard to implement with non-technical users?

I would just say that people aren't used to it. Also you need to decide how you want to send the email. Once on signup (long-lived token, not recommended), once a day (weird, annoying), or on demand (user gets email instead of entering password).

I think it's interesting but in practice passwords are more secure and people are used to them.

I was always under the impression that security trumps user-experience in the majority of cases - what happened to trying to prevent malicious users from harvesting user names by using captcha, non-specific error messages etc? Maybe I've had my head buried in the security game for too long...

Security should trump UX. In practice, though, UX almost always seems to trump security concerns.

> Security should trump UX.

In my view, security is just another part of the user experience. For one's bank, it's surely a large one. For most web services, though, it's pretty tiny. As a Quora user, I'm perfectly happy for them to increase usability substantially at the cost of a minor increase in risk.

> Security should trump UX.

Yes and no. Of course security is important, but no realistic system is ever known to be completely secure, so it's always a cost/benefit question.

If you take security far enough that your system ceases to be useful, then UX certainly won't matter, because you won't have any users.

More commonly, if you make security checks too disruptive, it can be counter-productive because users will start to circumvent the system. Consider all the stories you've heard of someone changing their "updated monthly" password by just adding the next number on the end, or writing the PIN for their credit card on a bit of paper they keep in their wallet, or having a note of their network password taped inside their desk draw. Or just be the guy at Microsoft who invented UAC in Vista. ;-)

I wouldn’t be happy, as a user, if I saw that information like this was made public about me on a site.

If you mistype your email address in Facebook, it will suggest your correct account on login fail. I'm not sure if it just does this blindly, or if it tracks where you are logging in from.

Didn't Facebook get bad press a while ago for revealing the user's name and profile picture when an incorrect password was entered?