Tell HN: Developers please don't do anything weird on log in pages | Hacker News Reader

Tell HN: Developers please don't do anything weird on log in pages

17 pointsbrandnewlow9 comments

I have a uservoice account, where I administer the help site for Windy Citizen. Today, I decided I wanted to sign in to check/update the settings I have on it. I click the "sign in" button on the uservoice front page and get this:

http://uservoice.com/signin

It's asking me for an e-mail and a username. Nowhere does it ask me for a password.

I've been thinking about this form for about 5 minutes, and I'm still not 100% sure how I'm supposed to use it. Do I enter in one? The other? I've been clicking around trying to find a password field somewhere so I can log into the account I set up.

Developers, please don't screw with stuff like this.

View on HN

It likely auto-generates one and sends it to your email.

This is a good lesson on usability if you (I assume pretty internet-literate) are thrown by this. Very important to note this error.

I have to agreed, it confused me as well a few weeks ago.

When I have a task or goal in mind on a site the last thing I want to do is tinker and figure out your new way to log in.

I'm curious what the general consensus is for using something like OAuth for authentication for sites with a non-technical focus. Personally, the login form implementation of StackOverflow is perfect. But I wonder whether asking people to log in using the credentials from another site is still a confusing concept if a portion of your userbase is non-technical.

If you enter your email, if it's an email that has signed up, the name field turns into a password field. I agree it's very confusing when trying it for the first time. I also imagine that there are a lot of duplicate accounts around, I know I have a few

Send them a link to this thread

Deleted comment

I did.

I haven't logged int uservoice in a few months. So I was half guessing at my e-mail address and username.

Normally, when I don't remember, the error prompts on the log in page will indicate if I'm trying the wrong creds. Then I can try another set of creds.

But on this form, instead of telling me my creds didn't match anyone, it registered a new account with the e-mail address and username I entered and auto-sent me an e-mail welcoming me to uservoice. Ugh.

I tried it again with a different e-mail address, this time it matched the e-mail address against one in its DB and changed the username field into a password field before I could enter something into the username field. I took this change as an indicate that I'd found the proper e-mail address, entered in my password and was logged in. The whole experience was confusing and annoying though, almost as bad as the whole OpenID click-hear-go-to-another-site-read-some-legal-stuff-click-there-go-back-to-original site UX disaster.

So anyone can enter an email address and find out immediately whether it corresponds to a valid account, without having to enter a password or anything else?

Security FAIL.

Agree. But alas this is pretty common nowadays.. Try Groupon's login page, you'll get email address not found error with any unregistered email addresses

Reply on news.ycombinator.com