3 ms·
This was my first thought too I saw it on Expensify yesterday Doesn't this break a best practice? If you input an email address it tells you whethere there IS
by gammateam 8y ago
This was my first thought too
I saw it on Expensify yesterday
Doesn't this break a best practice? If you input an email address it tells you whethere there IS or ISN'T a user, and if there IS it asks you for their password.
I thought the best practice was to make it unclear whether an email or username is in the system, which would make this a huge regression
- hombre_fatal 8y agoIt doesn't change anything. If the email doesn't exist, you can always redirect to the password form. If the user is confused about their credentials, they'll have to use the "I forgot" system in both cases.
- gammateam 8y agoExpensify shows an avatar for the user
- erichurkman 8y ago> I thought the best practice was to make it unclear whether an email or username is in the system It's useless obfuscation. 99% of systems that tell you "if you entered a valid username, we'll email you a password reset link" also don't allow duplicate accounts by email. Try to register a duplicate on their sign up page and they will tell you "this email address is already in use." Useless "security" obfuscation and creates a terrible user experience trying to reset passwords.