3 ms·

Tell HN: Developers please don't do anything weird on log in pages

17 points by brandnewlow 16y ago

I have a uservoice account, where I administer the help site for Windy Citizen. Today, I decided I wanted to sign in to check/update the settings I have on it. I click the "sign in" button on the uservoice front page and get this: http://uservoice.com/signin It's asking me for an e-mail and a username. Nowhere does it ask me for a password. I've been thinking about this form for about 5 minutes, and I'm still not 100% sure how I'm supposed to use it. Do I enter in one? The other? I've been clicking around trying to find a password field somewhere so I can log into the account I set up. Developers, please don't screw with stuff like this.

deleted 16y ago
[deleted]
- brandnewlow 16y ago
  I did. I haven't logged int uservoice in a few months. So I was half guessing at my e-mail address and username. Normally, when I don't remember, the error prompts on the log in page will indicate if I'm trying the wrong creds. Then I can try another set of creds. But on this form, instead of telling me my creds didn't match anyone, it registered a new account with the e-mail address and username I entered and auto-sent me an e-mail welcoming me to uservoice. Ugh. I tried it again with a different e-mail address, this time it matched the e-mail address against one in its DB and changed the username field into a password field before I could enter something into the username field. I took this change as an indicate that I'd found the proper e-mail address, entered in my password and was logged in. The whole experience was confusing and annoying though, almost as bad as the whole OpenID click-hear-go-to-another-site-read-some-legal-stuff-click-there-go-back-to-original site UX disaster.
  - captaincrowbar 16y ago
    So anyone can enter an email address and find out immediately whether it corresponds to a valid account, without having to enter a password or anything else? Security FAIL.
    - motocycle 16y ago
      Agree. But alas this is pretty common nowadays.. Try Groupon's login page, you'll get email address not found error with any unregistered email addresses
SHOwnsYou 16y ago
It likely auto-generates one and sends it to your email. This is a good lesson on usability if you (I assume pretty internet-literate) are thrown by this. Very important to note this error.
vyrotek 16y ago
I have to agreed, it confused me as well a few weeks ago. When I have a task or goal in mind on a site the last thing I want to do is tinker and figure out your new way to log in.
DevX101 16y ago
Send them a link to this thread
lukevdp 16y ago
If you enter your email, if it's an email that has signed up, the name field turns into a password field. I agree it's very confusing when trying it for the first time. I also imagine that there are a lot of duplicate accounts around, I know I have a few
uptown 16y ago
I'm curious what the general consensus is for using something like OAuth for authentication for sites with a non-technical focus. Personally, the login form implementation of StackOverflow is perfect. But I wonder whether asking people to log in using the credentials from another site is still a confusing concept if a portion of your userbase is non-technical.

17 points by brandnewlow 16y ago

deleted 16y ago

[deleted]

brandnewlow 16y ago
I did. I haven't logged int uservoice in a few months. So I was half guessing at my e-mail address and username. Normally, when I don't remember, the error prompts on the log in page will indicate if I'm trying the wrong creds. Then I can try another set of creds. But on this form, instead of telling me my creds didn't match anyone, it registered a new account with the e-mail address and username I entered and auto-sent me an e-mail welcoming me to uservoice. Ugh. I tried it again with a different e-mail address, this time it matched the e-mail address against one in its DB and changed the username field into a password field before I could enter something into the username field. I took this change as an indicate that I'd found the proper e-mail address, entered in my password and was logged in. The whole experience was confusing and annoying though, almost as bad as the whole OpenID click-hear-go-to-another-site-read-some-legal-stuff-click-there-go-back-to-original site UX disaster.
- captaincrowbar 16y ago
  So anyone can enter an email address and find out immediately whether it corresponds to a valid account, without having to enter a password or anything else? Security FAIL.
  - motocycle 16y ago
    Agree. But alas this is pretty common nowadays.. Try Groupon's login page, you'll get email address not found error with any unregistered email addresses

SHOwnsYou 16y ago

It likely auto-generates one and sends it to your email. This is a good lesson on usability if you (I assume pretty internet-literate) are thrown by this. Very important to note this error.

vyrotek 16y ago

I have to agreed, it confused me as well a few weeks ago. When I have a task or goal in mind on a site the last thing I want to do is tinker and figure out your new way to log in.

DevX101 16y ago

Send them a link to this thread

lukevdp 16y ago

If you enter your email, if it's an email that has signed up, the name field turns into a password field. I agree it's very confusing when trying it for the first time. I also imagine that there are a lot of duplicate accounts around, I know I have a few

uptown 16y ago

I'm curious what the general consensus is for using something like OAuth for authentication for sites with a non-technical focus. Personally, the login form implementation of StackOverflow is perfect. But I wonder whether asking people to log in using the credentials from another site is still a confusing concept if a portion of your userbase is non-technical.