Hacker News Reader

Comment by yason | Hacker News Reader

Someone heard "must validate all input", scratched his head for a while going about how to validate the password field, and thus came up with some artificial limitations? If so, it's a huge misconception about what it means to "validate" data. If not, someone's just really stupid.

This goes into the same category as validating email addresses (just go ahead and send the confirmation email and watch me not replying in case I entered a bad address, instead of complaining I can't use plus or some other allowed character in it) or my phone number (if you're picky about formatting I can already give you 01234567890 if I want so just let me, in the first place, type in a nicely formatted "+44-123 4567890" or something that I like) or asking me to provide something twice (I'll just copypaste from the first field, thanks; would be more useful if you just printed a confirmation of what I wrote onto the next page).

View on HN

Double entry when setting a password, at least, is reasonable: a typo in a password field is going to be impossible for you to spot.

It may be more useful and helpful to either show the password in cleartext, or provide a button that unmasks the password.

Double inputs tend to seduce the user to copy&paste.

> Double inputs tend to seduce the user to copy&paste.

Maybe for us geeks, but I think your Average Joe is more likely to just re-type it.

I went through a phase of copy/pasting double inputs. That phase ended when I copy/pasted a mistake from the first input and it caused a whole lot of hassle sorting it out.

Now I just make myself type it twice. I tell myself it's for my own protection.

An option to unmask is, IMO, the best option. Please never show passwords in cleartext by default. My thoughts on the matter: http://alanhogan.com/password-masking

asking me to provide something twice (I'll just copypaste from the first field, thanks; would be more useful if you just printed a confirmation of what I wrote onto the next page).

Asking for something (normally a password or email) twice is for your benefit -- to guard against typos. There are many typos you might miss visual confirmation of, I'm fairly certain the type-twice method is a sound one.

There are places, even Facebook's registration form, that make your re-enter your email address.

Asking passwords twice is quite ok--even Unix does it; it's the other things sometimes asked twice which is totally useless. Most commonly it's something like having to retype your email address. Woot?! You can already see it in plaintext so you can just correct any errors there.

Argh, no! How many people would actually bother to visually verify their address? A typo here is actually more problematic than in your password -- if you typo that, you'll be instantly aware of it and can do an e-mail reset.

If there's a typo in the e-mail field, you won't be aware of it until you forget your password and try to do a reset -- and for the majority of services, that means you are now completely locked out of your account.

Reply on news.ycombinator.com