Ask HN: Should I bother asking users to "confirm password"?

Just require them to sign up with a mobile number and SMS.

/s

No, don't do that. Unless you really need to.

I do request 'confirm password' but that was from feedback that users expect to input a password twice for a new account and it seems to add no friction.

IMO: No, do not ask them to confirm the password if they've already confirmed their email (which they can use to reset their password if they mistype it). If they haven't yet confirmed their email, then sure, ask them to confirm the password. But they could still make a mistake (e.g. if they copied from the wrong field in their password manager and then pasted it twice).

It does highlight an interesting race condition of sorts. There are two times when a user can set/change their password: (1) at signup (set it), and (2) after sign up (change it). After signup, you can simply require them to confirm their email before they change their password. But what if they mistype their password during signup, then logout from their first session before confirming their email? Will their account be stranded? If they haven't confirmed their email then you probably don't want to send a password reset request to it, right? (Or maybe you do?)

Arguably, it might make sense to allow sending password resets to unconfirmed emails. Because either the user set that email at signup, and thus there was no data for an attacker to steal, or they set it from within an authenticated session where they had already proved their identity. And then once you send the password reset email, you could even treat the successful reset as verification that they own the email.

I don't mind as long as you don't interfere with copy/paste (password manager just auto-fills both for me).

You can make the confirmation optional like: https://ph.leftium.com/

While you're at it, drop password rules that prevent strong, pronounceable/typeable passwords generated by my password manager like:

    lumpy empower susie classic sly stoppage calculate backache

It's much easier to type random words than random characters, especially on mobile keyboards. Symbols, numbers, and even upper case are more annoying to type.

Not if you provide the option to view the password as plainly visible text too. If it's obscured always, then yes.

Don't make me repeat my email, unless you're obscuring that too.

It makes more sense to confirm the email or have the second step in the register process be "Click the link we sent to your email..." You can't do "forgot password?" if the email is wrong.

Ultimately it boils down to how much friction your users are willing to tolerate. Or how often you want field emails from users who can't reset their PW and you find a typo in their email address in the DB

No. Further, don't use a "password" field that shows dots or asterisks for characters.

It's almost impossible to type on a cellphone "keyboard".

The threat of shoulder surfing is basically eliminated by tiny smartphone screens and font, held close to the face.