News for hackers. Stuff that matters.

A comment on New Approaches To Designing Log-In Forms. Parent comment

Re:New Approaches To Designing Log-In Forms by subsection1h on Monday August 22, 2011 @06:57PM (#2914512)
Well-designed registration forms should not reveal this. Our registration forms provide the error "Email address or password is incorrect. Please try again." Further, forgotten password forms, etc. should also not reveal this.
[ Parent | on HN ]
Re:New Approaches To Designing Log-In Forms by huhtenberg on Monday August 22, 2011 @08:04PM (#2914719)
Pssst... the registration form, not the login form. As in sorry, we cannot create you an account as your selected username has already been taken.
[ Parent | on HN ]
Re:New Approaches To Designing Log-In Forms by itsnotvalid on Tuesday August 23, 2011 @05:33AM (#2915962)
as a matter of fact, they don't strictly tell you who the person is with an email address... they just tell you that the email address is taken.
[ Parent | on HN ]