5 ms·

LOL this reminds me of a hilarious bug (but only in hindsight!) I had with Discord just three days ago! I tried to login to Discord. It detected a novel browse

by jug 3y ago

LOL this reminds me of a hilarious bug (but only in hindsight!) I had with Discord just three days ago! I tried to login to Discord. It detected a novel browser or location. Sure, this stuff can happen. It wanted to confirm that I was still me and asked me for my e-mail address. I gave it and it said "This e-mail address is already registered". What. Of course it is. It's me. Mine. The one I have registered with you. Since I have a few useful things tied to Discord, I felt my pulse go up. I googled for answers, found a Reddit thread with this specific problem. They said "Hey, if you use Gmail you can use the dots-are-ignored-feature to give Discord a "new" mail that will still go to you, allowing you to verify it!" (https://www.reddit.com/r/discordapp/comments/12makhd/verify_email_already_registered/ https://www.reddit.com/r/discordapp/comments/12makhd/verify_...) Sounded clever so I gave it a fore.name.sur.name@gmail.com variant. Sure enough, I got the mail. I logged in. I gasped as I realized Discord had now created a new, empty user for me! It somehow thought I was a brand new user despite this was only a user account _verification_ due to changed IP or whatever to begin with. I tried logging in to my original account once more and now I somehow got in! The verification on my new account had somehow triggered (cookie? I have no idea) that I was trustworthy again. Phew! I promptly deleted the new-account-going-to-same-mail and breathed normally again...

Panzer04 3y ago
I've done this at least twice for the same reasons, and it's lead to me pulling my number off discord twice now. It's stupid how similar logging in and creating an account look.
alduin32 3y ago
> I promptly deleted the new-account-going-to-same-mail and breathed normally again... I think at that point I would just have been too scared that this would cascade-delete the old account as well ^^
TheHumanist 3y ago
I hadn't thought of getting possibly locked out of Discord for something so stupid. I have so much going on in there as far as dev comms... That makes me nervous now. Is there a way to export anything just in case?
- xigoi 3y ago
  The joys of using a proprietary walled-garden platform.
cnity 3y ago
Spotify once had a very similar issue which actually allowed hijacking of other accounts. https://engineering.atspotify.com/2013/06/creative-usernames/ https://engineering.atspotify.com/2013/06/creative-usernames...
joshxyz 3y ago
what would be the best fix for this? when checking for dupes, ignore dots on all leftside of all emails?
- TheDong 3y ago
  What actually happened here is that the parent commenter, instead of clicking "login", entered their username into a "enter a display name" prompt on the home page, which registers a new account using the string you entered as a _display name_, and generates a random username. The parent poster then did not realize they had created a new account and, even when it told them their email address was registered to a different account, somehow didn't realize they should go click login instead. I think the easiest way for discord to make this a not-confusing experience for people who aren't tech savvy enough to click "login" to login, is to make it so the signup flow is a normal explicit "Enter email, enter display name, enter username" prompt, not a flow where they silently create a username if you _just_ enter a displayname. The reason this would help is because forcing the user to enter a username early on lets you display a "Would you like to login instead?" message if the username conflicts. Having the user enter a non-unique displayname, and silently creating a random unique username, means the signup flow no longer has the ability to say "Are you sure you don't want to login?" Of course, discord mostly targets relatively tech-savvy users, not the average hacker-news-user, so it probably isn't that big a deal for their main demographic.
- dgoldstein0 3y ago
  No, just @gmail.com ones, and maybe a few others - not all email providers ignore dots. But if you do this you better do it everywhere you use email. Otherwise you can get some pretty nasty bugs where two emails aren't considered the same sometimes, are are considered the same other times.
- sznio 3y ago
  Not trying to mislead existing users into creating new accounts. It's really annoying that on some websites you have to open up multiple dropdowns to reach the login page, also passing five sign up buttons on the way there. It's even filled with dark patterns, with the sign up button blinking and screaming at you to click it every single time, while the login button is made smaller and grayed out. I remember GitHub pulling this shit some time ago. Once I truly couldn't find the login button and gave up, opting to guess the URL/find it in history. What is even the purpose of that? Is it truly a scheme to get users to sign up multiple times for the same service so that the user number goes higher? That seems too dumb.
TheDong 3y ago
This isn't a bug. Instead of clicking the "login" button on discord's home page, you clicked the "Open discord in your browser" button. This, by default if you're not logged in, takes you to a create account flow. The prompt you entered your _username_ into was the "Pick a display name" prompt. If you enter, say, "user" it silently adds numbers to your displayname to make a new username ("user1234"), rather than redirecting you to the login page or prompting you about it (like most other sites do). At the end of the flow is a "Finish signing up", "claim your account" prompt (which really is the end of the "create a new account" flow, the ephemeral account without an email you're using there is in a partially signed up state). This is the box where you were entering your email, getting a conflict, and ended up using a new email to create a totally new account. I know people who use hacker news are on-average much less tech savvy than the average discord user, so I can get why you missed the login button on the home page and instead went through the "create account flow", but everything that happened is "working as intended" rather than a "bug". I do agree the flow there is pretty confusing. They've managed to make the new user signup flow so optimized you didn't even realize you were doing it. Still, by the time it was telling you your email was already registered, you really should have slowed down and noticed it was telling you you were creating a new account rather than using a new email address for some reason.
- philwelch 3y ago
  > This isn't a bug. Okay. > Instead of clicking the "login" button on discord's home page, you clicked the "Open discord in your browser" button. Sure. > This, by default if you're not logged in, takes you to a create account flow. That is a UX bug! Why does opening discord in my browser automatically imply I need to create a new account? > I know people who use hacker news are on-average much less tech savvy than the average discord user And yet, somehow, much more tech savvy than the average Discord UX designer.
- fingerlocks 3y ago
  > I know people who use hacker news are on-average much less tech savvy than the average discord user Sarcasm? Serious question. I used Discord exactly once, many years ago, and it appeared to be mostly children playing video games. I hear things have changed, but it’s hard to imagine a more tech savvy group than HN.

by jug 3y ago

Panzer04 3y ago

I've done this at least twice for the same reasons, and it's lead to me pulling my number off discord twice now. It's stupid how similar logging in and creating an account look.

alduin32 3y ago

> I promptly deleted the new-account-going-to-same-mail and breathed normally again... I think at that point I would just have been too scared that this would cascade-delete the old account as well ^^

TheHumanist 3y ago

I hadn't thought of getting possibly locked out of Discord for something so stupid. I have so much going on in there as far as dev comms... That makes me nervous now. Is there a way to export anything just in case?

xigoi 3y ago
The joys of using a proprietary walled-garden platform.

cnity 3y ago

Spotify once had a very similar issue which actually allowed hijacking of other accounts. https://engineering.atspotify.com/2013/06/creative-usernames/ https://engineering.atspotify.com/2013/06/creative-usernames...

joshxyz 3y ago

what would be the best fix for this? when checking for dupes, ignore dots on all leftside of all emails?

TheDong 3y ago
What actually happened here is that the parent commenter, instead of clicking "login", entered their username into a "enter a display name" prompt on the home page, which registers a new account using the string you entered as a _display name_, and generates a random username. The parent poster then did not realize they had created a new account and, even when it told them their email address was registered to a different account, somehow didn't realize they should go click login instead. I think the easiest way for discord to make this a not-confusing experience for people who aren't tech savvy enough to click "login" to login, is to make it so the signup flow is a normal explicit "Enter email, enter display name, enter username" prompt, not a flow where they silently create a username if you _just_ enter a displayname. The reason this would help is because forcing the user to enter a username early on lets you display a "Would you like to login instead?" message if the username conflicts. Having the user enter a non-unique displayname, and silently creating a random unique username, means the signup flow no longer has the ability to say "Are you sure you don't want to login?" Of course, discord mostly targets relatively tech-savvy users, not the average hacker-news-user, so it probably isn't that big a deal for their main demographic.
dgoldstein0 3y ago
No, just @gmail.com ones, and maybe a few others - not all email providers ignore dots. But if you do this you better do it everywhere you use email. Otherwise you can get some pretty nasty bugs where two emails aren't considered the same sometimes, are are considered the same other times.
sznio 3y ago
Not trying to mislead existing users into creating new accounts. It's really annoying that on some websites you have to open up multiple dropdowns to reach the login page, also passing five sign up buttons on the way there. It's even filled with dark patterns, with the sign up button blinking and screaming at you to click it every single time, while the login button is made smaller and grayed out. I remember GitHub pulling this shit some time ago. Once I truly couldn't find the login button and gave up, opting to guess the URL/find it in history. What is even the purpose of that? Is it truly a scheme to get users to sign up multiple times for the same service so that the user number goes higher? That seems too dumb.

TheDong 3y ago

This isn't a bug. Instead of clicking the "login" button on discord's home page, you clicked the "Open discord in your browser" button. This, by default if you're not logged in, takes you to a create account flow. The prompt you entered your _username_ into was the "Pick a display name" prompt. If you enter, say, "user" it silently adds numbers to your displayname to make a new username ("user1234"), rather than redirecting you to the login page or prompting you about it (like most other sites do). At the end of the flow is a "Finish signing up", "claim your account" prompt (which really is the end of the "create a new account" flow, the ephemeral account without an email you're using there is in a partially signed up state). This is the box where you were entering your email, getting a conflict, and ended up using a new email to create a totally new account. I know people who use hacker news are on-average much less tech savvy than the average discord user, so I can get why you missed the login button on the home page and instead went through the "create account flow", but everything that happened is "working as intended" rather than a "bug". I do agree the flow there is pretty confusing. They've managed to make the new user signup flow so optimized you didn't even realize you were doing it. Still, by the time it was telling you your email was already registered, you really should have slowed down and noticed it was telling you you were creating a new account rather than using a new email address for some reason.

philwelch 3y ago
> This isn't a bug. Okay. > Instead of clicking the "login" button on discord's home page, you clicked the "Open discord in your browser" button. Sure. > This, by default if you're not logged in, takes you to a create account flow. That is a UX bug! Why does opening discord in my browser automatically imply I need to create a new account? > I know people who use hacker news are on-average much less tech savvy than the average discord user And yet, somehow, much more tech savvy than the average Discord UX designer.
fingerlocks 3y ago
> I know people who use hacker news are on-average much less tech savvy than the average discord user Sarcasm? Serious question. I used Discord exactly once, many years ago, and it appeared to be mostly children playing video games. I hear things have changed, but it’s hard to imagine a more tech savvy group than HN.