21–30 of 178 posts
Does anybody else think unmasking the password field is a terrible idea?
I'm also interested in the elimination of the post sign-up confirmation email. I'd rather get a "Welcome! If you didn't sign up for this service, click here" email, but I can imagine that if I didn't actually sign up for the service, I'd never want to "click here" for fear of spam. There has to be another option, though. Anyone have any bright ideas?
One that gets missed almost everywhere is: if I type the wrong username or password, keep my username in the field (so many erase the forms when returning the error). That way I can tell if the mistake was in my username or my password and if it was in my password I don't have to retype everything.
Not true anymore. What you could do is add a hidden field with value=encrypt(timestamp+salt) and only accept the form if the decrypted timestamp is at most x hours old. If you want to further restrict it, you could also add the IP to the encrypted value. This will fail if a user gets a new IP between loading the form and submitting it (laptop user moving around, VPN gateway changes etc).
I have never understood why I need to type my password twice. Inevitably I just copy what I wrote in the first box into the second. I'm also interested in the elimination of the post sign-up confirmation email. I'd rather get a "Welcome! If you didn't sign up for this service, click here" email, but I can imagine that if I didn't actually sign up for the service, I'd never want to "click here" for fear of spam. There…
One that gets missed almost everywhere is: if I type the wrong username or password, keep my username in the field (so many erase the forms when returning the error). That way I can tell if the mistake was in my username or my password and if it was in my password I don't have to retype everything.
i think its done to prevent brute force attacks on passwords. If someone knows that username was correct and password wasn't, he knows something! That's why the message 'username or password does not match' and that's why both the fields needs to be empty when page loads with error.
Admittedly I hadn't heard of using a client-side JS input box as an alternative to a Captcha. Does that sort of thing actually work, or can spammers get around it? Is there any anecdotal data to suggest that that's a better method? (not snarking; actually curious)
One that gets missed almost everywhere is: if I type the wrong username or password, keep my username in the field (so many erase the forms when returning the error). That way I can tell if the mistake was in my username or my password and if it was in my password I don't have to retype everything.
i think its done to prevent brute force attacks on passwords. If someone knows that username was correct and password wasn't, he knows something! That's why the message 'username or password does not match' and that's why both the fields needs to be empty when page loads with error.
If you're on a community based site where others can see your username, there's no reason to hide it. Anybody trying to brute force your password is probably specifically targeting your account.
On the other hand, if you're on a service where other people cannot see your username, it would indeed be better to return a 'username or password does not match' error.
Earlier quoted context omitted.
While you're right that all CAPTCHAs are annoying, the CAPTCHA ads are a whole different level of annoying. I think you'd lose more goodwill than you'd gain in money from doing this.
depends, I believe it will depend on what the user has to type.