3 ms·
> 99.9% of websites on the Internet will only let you create one account for each email address. So if you want to see if an email address has an account, try s
by mbesto 12y ago
> 99.9% of websites on the Internet will only let you create one account for each email address. So if you want to see if an email address has an account, try signing up for a new account with the same email address.
That's terrible UX.
> But there's a tradeoff there between security and UX, I hear you say. I am trying to show you there is no tradeoff; you are choosing between a better user experience and a worse user experience.
I didn't reach this conclusion at all. Am I missing something?
- andrewstuart2 12y ago> That's terrible UX. I think the goal when the User is a malicious attacker is for them to have a terrible UX.
- mbesto 12y agoHuh? He's suggesting that as a Real User that if you don't whether you have an account at all is to just sign up again. People use multiple emails for different accounts all of the time. How is that not a frustrating experience for the Real User?
- waxjar 12y agoThat's not what is meant. An attacker who wants to find out of if the person with "example@example.com" has on account on your website, could try signing up with "example@example.com". If they get an error message, they know the person has an account on the website.
- saidajigumi 12y ago> That's terrible UX. Your complaint is extremely unclear. Could you elaborate? Are you suggesting that websites should allow multiple accounts per email address as a matter of course?
- mbesto 12y agoNo, my point is that signing up for a service (potentially) for a second time is a really frustrating experience. Why not push the user to reset their password?
- bluedino 12y ago>> I didn't reach this conclusion at all. Am I missing something? He's saying that letting the user know the password is wrong, and not the email address, is a better error message. Since an attacker can simply try to register a new account to check if an account exists.