Hacker News Reader

Comment by NikkiA | Hacker News Reader

I agree with the direction one of the comments takes - if you're going to this trouble, why differentiate, if the username isn't taken, take the user straight to a 'confirm your password to create account'. One dialog box, two functions. Having to notice and choose the radiobutton is just another barrier to both types of users.

View on HN

This sort of approach will leak information about what usernames exist in the system, which has security implications.

Depending on the nature of the application you may or may not need to worry about this (e.g., obviously irrelevant if the site has a user list that shows the login names).

Most sign up forms give away that information anyway--try putting in a name or email that's already taken and you'll get a form validation error.

There's at least one problem with this approach: trying to sign up with a username that's already taken. If you want the username "foobar" and it's already taken, you're just going to get a "wrong password" error, when you really wanted to sign up. That certainly creates some sort of user confusion.

This approach only really works with signups that ask for an E-mail instead of a separate username.

As should all of them, really...

False. If I'm just using a web app myself, email may be sufficient, but if I'm creating a public-facing profile, I want a username to be visible, not my email address.

Of course, there is no reason why shouldn't you be able to log in using any of the unique information in your profile, be it email, your username/alias, your phone number etc.

If an existing user misspells their username, being taken to a register screen is not where they want to go.

I implemented exactly that for my web app (one dialog box - after the user enters an E-mail, automatically validate it and if it is unrecognized, just add a confirm password field and change the button to "Register"), and the response has been entirely positive.

His webapp: http://gomockingbird.com/mockingbird/

Reply on news.ycombinator.com