4 ms·
Yes, and it is very hard to show a generic error during sign up. "There is an error with your data..." WHAT ERROR? I've typed 10 fields. I think a better appr
by jfroma 12y ago
Yes, and it is very hard to show a generic error during sign up.
"There is an error with your data..." WHAT ERROR? I've typed 10 fields.
I think a better approach is to rate limit wrong usernames / emails during sign in.
- x1j7xJuzX 12y agoIt's not a difficult problem to solve. Just let the sign-up succeed whether an account already exists for the email or not. Then say "You will receive an email with instructions to complete your registration". If there was no existing account, send an email with the text: "An account was created for this email address at Example.com. If you requested this account, you may activate it by clicking here: https://..." https://..." If there was an existing account, send: "An attempt was made to create a new account at Example.com for this email address, but you already have an account. If you have forgotten your password, visit https://..." https://..."
- jdbernard 12y agoThat works for sign-up, but not for the far more common case of sign-in.
- birdmanjeremy 12y agoIf you use this approach, the idea is then that you use a generic login failure message. This prevents leaking of any account information, but provides a different (poorer, IMO) user experience.
- birdmanjeremy 12y agoYes, this was the alternative we discussed. We opted to go with the simpler (and very common) signup process, which does admittedly leak some information.
- birdmanjeremy 12y agoThis is exactly the approach we took.