4 ms·

I see companies trying to solve a similar issue on their password reset forms. They ask you to enter an email address - then give you a reply "if that email exi

I see companies trying to solve a similar issue on their password reset forms. They ask you to enter an email address - then give you a reply "if that email exists, we have sent a password reminder there". The problem is these sames sites have a self-signup, using a unique email as your login. So you can already find out if an email address is in use or not. If you've going to 'leak' the data one way or another, dont sacrifice UX for the sake of it.

Xylakant 9y ago
Do the same thing on the signup page: If the email is already registered just progress the same way - send an email to that address and notify them that they already have an account.
- shinratdr 9y ago
  Which is great for most accounts, but what about a primary? How do you sign up for Gmail without an email account in this case?
  - lallysingh 9y ago
    Use your shudder isp-provided one. Hello IAmBindingMyselfUnnecessarilyTo@comcast.net
  - Xylakant 9y ago
    well, obviously this will not work for a primary account. It also adds friction the signup process, leading to lower conversion rations. But for some use-cases that may be a valid trade-off. Think dating sites, ..., stuff where knowing that a certain email is subscribed already may be embarrassing or worse (gay dating websites in certain countries).
    - shinratdr 9y ago
      Oh absolutely, it's a good system and many sites already utilize it. I only mentioned the Gmail example because that's what the article was about, it sounded like you were suggesting a solution for that scenario.
  - cryptarch 9y ago
    ISP email or any provider that doesn't ask for a secondary account, like Mail.com.
blincoln 9y ago
This is actually not difficult to address. Modify the account creation process so that the first step is to enter an email address. If the account does not already exist, an account activation link/code is sent. If it does, a password reset link/code is sent.
- pavel_lishin 9y ago
  > If the account does not already exist, an account activation link/code is sent. That's not great for all use cases, though - if I'm just trying to check out of a store, I don't want to have to bounce to my email to confirm stuff.
  - JimDabell 9y ago
    If you're just trying to check out of a store, you don't have to sign up for an account at all. Or if you do want to create an account, you can have it as an optional step after you've placed the order.
elif 9y ago
yeah but which signup form doesn't have a rate limit?

Xylakant 9y ago

Do the same thing on the signup page: If the email is already registered just progress the same way - send an email to that address and notify them that they already have an account.

shinratdr 9y ago
Which is great for most accounts, but what about a primary? How do you sign up for Gmail without an email account in this case?
- lallysingh 9y ago
  Use your shudder isp-provided one. Hello IAmBindingMyselfUnnecessarilyTo@comcast.net
- Xylakant 9y ago
  well, obviously this will not work for a primary account. It also adds friction the signup process, leading to lower conversion rations. But for some use-cases that may be a valid trade-off. Think dating sites, ..., stuff where knowing that a certain email is subscribed already may be embarrassing or worse (gay dating websites in certain countries).
  - shinratdr 9y ago
    Oh absolutely, it's a good system and many sites already utilize it. I only mentioned the Gmail example because that's what the article was about, it sounded like you were suggesting a solution for that scenario.
- cryptarch 9y ago
  ISP email or any provider that doesn't ask for a secondary account, like Mail.com.

blincoln 9y ago

This is actually not difficult to address. Modify the account creation process so that the first step is to enter an email address. If the account does not already exist, an account activation link/code is sent. If it does, a password reset link/code is sent.

pavel_lishin 9y ago
> If the account does not already exist, an account activation link/code is sent. That's not great for all use cases, though - if I'm just trying to check out of a store, I don't want to have to bounce to my email to confirm stuff.
- JimDabell 9y ago
  If you're just trying to check out of a store, you don't have to sign up for an account at all. Or if you do want to create an account, you can have it as an optional step after you've placed the order.

elif 9y ago

yeah but which signup form doesn't have a rate limit?