News for hackers. Stuff that matters.
Re:“Invalid Username or Password”: a useless security measure by Al-Khwarizmi on Wednesday November 23, 2022 @09:59AM (#33719917)
In simple registrations this is fine. In multi-page registrations with long forms, it can waste the user's time by making them input all the data again when it wasn't needed, though.

Except in really critical applications like payments, etc., as a user I'd rather have the convenience of being warned early about already having an account that the little extra security.

Re:“Invalid Username or Password”: a useless security measure by Xylakant on Wednesday November 23, 2022 @10:12AM (#33720112)
How often does it happen that you fill out a multi-page registration form just to notify you that you already have an account? I rarely bump into the issue of already having an account that I forgot.

Is saving that extra amount of work in a rare case a concern in practice? Sure, it would annoy me a bit if it happened to me, but I'd be more like "man, I'm stupid" instead of "man, this site is stupid, I'll never go there again."

Re:“Invalid Username or Password”: a useless security measure by Al-Khwarizmi on Wednesday November 23, 2022 @01:14PM (#33722618)
It has happened to me sometimes with ecommerce websites that I only use once every few years.

Only a mild annoyance, but still more annoying than it would be to have someone access my account on such websites (which would be basically negligible, as I don't store payment information there, and you have to multiply it by the also negligible probability that the information leak from the login form is key in letting the bad dudes access my account).

Re:“Invalid Username or Password”: a useless security measure by thomastjeffery on Wednesday November 23, 2022 @10:02AM (#33719956)
You shouldn't be doing long web forms before creating an account anyway.
Re:“Invalid Username or Password”: a useless security measure by layer8 on Wednesday November 23, 2022 @10:26AM (#33720335)
This is commonly the case for online shopping, where account creation is optional and may only occur after confirmation, but the order will be placed regardless.
Re:“Invalid Username or Password”: a useless security measure by darrinmn on Wednesday November 23, 2022 @10:56AM (#33720792)
Re:“Invalid Username or Password”: a useless security measure by thomastjeffery on Wednesday November 23, 2022 @10:58AM (#33720829)
But in that case, there is still an account (just without login ability), and you are probably even sending an email.

So in the email you can include a link to optional account (username/password) creation.

And if you aren't sending an email, then the user has clearly decided not to create an account.

Re:“Invalid Username or Password”: a useless security measure by layer8 on Wednesday November 23, 2022 @11:29AM (#33721246)
The problem is if an account for that email already exists, see https://news.ycombinator.com/item?id=33720063.
Re:“Invalid Username or Password”: a useless security measure by zhfliz on Wednesday November 23, 2022 @10:07AM (#33720030)
You shouldn't be taking my email just to demand lots of information from me after I already gave my email to you.

If you demand lots of information that should be clear right away.

Re:“Invalid Username or Password”: a useless security measure by thomastjeffery on Wednesday November 23, 2022 @10:23AM (#33720277)
I can sympathize with your frustration about long web forms, but that seems to me like a separate issue with a separate solution.

People shouldn't be making long forms part of account creation unless absolutely necessary; in which case it should already be obvious to the user that it is.

If it's somehow necessary but not obvious, you can put up a friendly warning. Maybe something like, "Step 1/12" or "expected registration time 15min."

Re:“Invalid Username or Password”: a useless security measure by TeMPOraL on Wednesday November 23, 2022 @11:47AM (#33721542)
So now you're saying web UX should actually improve and give up the major disadvantage it has over paper forms: hiding the full flow from the (l)users.

/s, but only slightly.

You're right, of course. The answer is the one nobody wants to hear: you can tell users what you'll want from them, then ask to create an account, and then ask them to do the things you outlined before registration.

As for multi-page forms, they make sense if you target non-JavaScript use, but if your site is already an SPA, you might as well present the form in full, and conditionally disable parts that don't apply based on earlier inputs. This is the way to improve over the paper UX.