Re:New Approaches To Designing Log-In Forms
by Tichy on Monday August 22, 2011 @11:33AM
(#2912778)
Revealing user names (As in "you are trying to log in as Luke") is usually considered a security issue, though.
[ Parent
| on HN ]
This was my first thought as well. I thought it was bad when it just verified that you had used a correct username after attempting to log in, then I kept reading and saw the auto-complete combobox of usernames...
Re:New Approaches To Designing Log-In Forms
by trafficlight on Monday August 22, 2011 @01:03PM
(#2913140)
That combobox was baffling.
My first thought was: what about duplicate names?
Re:New Approaches To Designing Log-In Forms
by trafficlight on Monday August 22, 2011 @02:45PM
(#2913556)
Then it just gives you the available passwords as well. You select the right combination. Easy peasy.
I believe revealing whether or not an email address has an account is also considered a security issue.
Validation on registration form reveals this already.
Re:New Approaches To Designing Log-In Forms
by subsection1h on Monday August 22, 2011 @06:57PM
(#2914512)
Well-designed registration forms should not reveal this. Our registration forms provide the error "Email address or password is incorrect. Please try again." Further, forgotten password forms, etc. should also not reveal this.
Re:New Approaches To Designing Log-In Forms
by huhtenberg on Monday August 22, 2011 @08:04PM
(#2914719)
Pssst... the registration form, not the login form. As in sorry, we cannot create you an account as your selected username has already been taken.
Re:New Approaches To Designing Log-In Forms
by itsnotvalid on Tuesday August 23, 2011 @05:33AM
(#2915962)
as a matter of fact, they don't strictly tell you who the person is with an email address... they just tell you that the email address is taken.
Yes, and in this case the designer made a (hopefully conscious) decision that usability was more important to the user than the information that an attacker would gain. These sorts of decisions are the hard part of building web applications; there's no right answer applicable to all situations, you have to use judgment and experience to gauge how to balance the competing needs of your users and your business.
Re:New Approaches To Designing Log-In Forms
by danellis on Monday August 22, 2011 @01:32PM
(#2913256)
Probably doesn't make much of a difference on those sites that have public profiles, though. They typically have the username in the URL anyway.
Re:New Approaches To Designing Log-In Forms
by snorkel on Monday August 22, 2011 @02:52PM
(#2913597)
... and not to mention a user privacy violation.
Re:New Approaches To Designing Log-In Forms
by huhtenberg on Monday August 22, 2011 @08:05PM
(#2914724)
How so? Please do elaborate.
(edit) In a context of a system that allows anyone to register new account, which appears to be what the linked article focuses on.
It's probably a minor issue, but if you can check for existing user names, you have a much easier time trying to find the matching password. Also, it could be a privacy issue (knowing user x is a customer of service y). Showing a photo as well...
Of course it depends on the context. On Hacker News all user names are visible anyway.