3 ms·

Ask HN: Should I bother asking users to "confirm password"?

5 points by andrewstuart 3y ago

chiefalchemist 3y ago
It makes more sense to confirm the email or have the second step in the register process be "Click the link we sent to your email..." You can't do "forgot password?" if the email is wrong. Ultimately it boils down to how much friction your users are willing to tolerate. Or how often you want field emails from users who can't reset their PW and you find a typo in their email address in the DB
chatmasta 3y ago
IMO: No, do not ask them to confirm the password if they've already confirmed their email (which they can use to reset their password if they mistype it). If they haven't yet confirmed their email, then sure, ask them to confirm the password. But they could still make a mistake (e.g. if they copied from the wrong field in their password manager and then pasted it twice). It does highlight an interesting race condition of sorts. There are two times when a user can set/change their password: (1) at signup (set it), and (2) after sign up (change it). After signup, you can simply require them to confirm their email before they change their password. But what if they mistype their password during signup, then logout from their first session before confirming their email? Will their account be stranded? If they haven't confirmed their email then you probably don't want to send a password reset request to it, right? (Or maybe you do?) Arguably, it might make sense to allow sending password resets to unconfirmed emails. Because either the user set that email at signup, and thus there was no data for an attacker to steal, or they set it from within an authenticated session where they had already proved their identity. And then once you send the password reset email, you could even treat the successful reset as verification that they own the email.
throwaway167 3y ago
Just require them to sign up with a mobile number and SMS. /s No, don't do that. Unless you really need to. I do request 'confirm password' but that was from feedback that users expect to input a password twice for a new account and it seems to add no friction.
- andrewstuart 3y ago
  I agree with this. I have found users really like their signup process to be the same as what they have come to expect, even if there is a better way.
bediger4000 3y ago
No. Further, don't use a "password" field that shows dots or asterisks for characters. It's almost impossible to type on a cellphone "keyboard". The threat of shoulder surfing is basically eliminated by tiny smartphone screens and font, held close to the face.
Leftium 3y ago
I don't mind as long as you don't interfere with copy/paste (password manager just auto-fills both for me). You can make the confirmation optional like: https://ph.leftium.com/ https://ph.leftium.com/ While you're at it, drop password rules that prevent strong, pronounceable/typeable passwords generated by my password manager like: lumpy empower susie classic sly stoppage calculate backache It's much easier to type random words than random characters, especially on mobile keyboards. Symbols, numbers, and even upper case are more annoying to type.
quantified 3y ago
Not if you provide the option to view the password as plainly visible text too. If it's obscured always, then yes. Don't make me repeat my email, unless you're obscuring that too.

5 points by andrewstuart 3y ago

It makes more sense to confirm the email or have the second step in the register process be "Click the link we sent to your email..." You can't do "forgot password?" if the email is wrong. Ultimately it boils down to how much friction your users are willing to tolerate. Or how often you want field emails from users who can't reset their PW and you find a typo in their email address in the DB

chatmasta 3y ago

IMO: No, do not ask them to confirm the password if they've already confirmed their email (which they can use to reset their password if they mistype it). If they haven't yet confirmed their email, then sure, ask them to confirm the password. But they could still make a mistake (e.g. if they copied from the wrong field in their password manager and then pasted it twice). It does highlight an interesting race condition of sorts. There are two times when a user can set/change their password: (1) at signup (set it), and (2) after sign up (change it). After signup, you can simply require them to confirm their email before they change their password. But what if they mistype their password during signup, then logout from their first session before confirming their email? Will their account be stranded? If they haven't confirmed their email then you probably don't want to send a password reset request to it, right? (Or maybe you do?) Arguably, it might make sense to allow sending password resets to unconfirmed emails. Because either the user set that email at signup, and thus there was no data for an attacker to steal, or they set it from within an authenticated session where they had already proved their identity. And then once you send the password reset email, you could even treat the successful reset as verification that they own the email.

throwaway167 3y ago

Just require them to sign up with a mobile number and SMS. /s No, don't do that. Unless you really need to. I do request 'confirm password' but that was from feedback that users expect to input a password twice for a new account and it seems to add no friction.

andrewstuart 3y ago
I agree with this. I have found users really like their signup process to be the same as what they have come to expect, even if there is a better way.

bediger4000 3y ago

No. Further, don't use a "password" field that shows dots or asterisks for characters. It's almost impossible to type on a cellphone "keyboard". The threat of shoulder surfing is basically eliminated by tiny smartphone screens and font, held close to the face.

Leftium 3y ago

I don't mind as long as you don't interfere with copy/paste (password manager just auto-fills both for me). You can make the confirmation optional like: https://ph.leftium.com/ https://ph.leftium.com/ While you're at it, drop password rules that prevent strong, pronounceable/typeable passwords generated by my password manager like: lumpy empower susie classic sly stoppage calculate backache It's much easier to type random words than random characters, especially on mobile keyboards. Symbols, numbers, and even upper case are more annoying to type.

quantified 3y ago

Not if you provide the option to view the password as plainly visible text too. If it's obscured always, then yes. Don't make me repeat my email, unless you're obscuring that too.