Revealing user names (As in "you are trying to log in as Luke") is usually considered a security issue, though.
I believe revealing whether or not an email address has an account is also considered a security issue.
New Approaches To Designing Log-In Forms
11–20 of 29 posts
Re: New Approaches To Designing Log-In Forms
#12Revealing user names (As in "you are trying to log in as Luke") is usually considered a security issue, though.
This was my first thought as well. I thought it was bad when it just verified that you had used a correct username after attempting to log in, then I kept reading and saw the auto-complete combobox of usernames...
That combobox was baffling.
Re: New Approaches To Designing Log-In Forms
#13Revealing user names (As in "you are trying to log in as Luke") is usually considered a security issue, though.
This was my first thought as well. I thought it was bad when it just verified that you had used a correct username after attempting to log in, then I kept reading and saw the auto-complete combobox of usernames...
My first thought was: what about duplicate names?
Re: New Approaches To Designing Log-In Forms
#14I was always under the impression that security trumps user-experience in the majority of cases - what happened to trying to prevent malicious users from harvesting user names by using captcha, non-specific error messages etc? Maybe I've had my head buried in the security game for too long...
Security should trump UX. In practice, though, UX almost always seems to trump security concerns.
Re: New Approaches To Designing Log-In Forms
#15Revealing user names (As in "you are trying to log in as Luke") is usually considered a security issue, though.
Probably doesn't make much of a difference on those sites that have public profiles, though. They typically have the username in the URL anyway.
Re: New Approaches To Designing Log-In Forms
#16Earlier quoted context omitted.
This was my first thought as well. I thought it was bad when it just verified that you had used a correct username after attempting to log in, then I kept reading and saw the auto-complete combobox of usernames...
My first thought was: what about duplicate names?
Then it just gives you the available passwords as well. You select the right combination. Easy peasy.
Re: New Approaches To Designing Log-In Forms
#17Revealing user names (As in "you are trying to log in as Luke") is usually considered a security issue, though.
... and not to mention a user privacy violation.
Re: New Approaches To Designing Log-In Forms
#18Revealing user names (As in "you are trying to log in as Luke") is usually considered a security issue, though.
Yes, and in this case the designer made a (hopefully conscious) decision that usability was more important to the user than the information that an attacker would gain. These sorts of decisions are the hard part of building web applications; there's no right answer applicable to all situations, you have to use judgment and experience to gauge how to balance the competing needs of your users and your business.
Re: New Approaches To Designing Log-In Forms
#19I was always under the impression that security trumps user-experience in the majority of cases - what happened to trying to prevent malicious users from harvesting user names by using captcha, non-specific error messages etc? Maybe I've had my head buried in the security game for too long...
Security should trump UX. In practice, though, UX almost always seems to trump security concerns.
> Security should trump UX.
Yes and no. Of course security is important, but no realistic system is ever known to be completely secure, so it's always a cost/benefit question.
If you take security far enough that your system ceases to be useful, then UX certainly won't matter, because you won't have any users.
More commonly, if you make security checks too disruptive, it can be counter-productive because users will start to circumvent the system. Consider all the stories you've heard of someone changing their "updated monthly" password by just adding the next number on the end, or writing the PIN for their credit card on a bit of paper they keep in their wallet, or having a note of their network password taped inside their desk draw. Or just be the guy at Microsoft who invented UAC in Vista. ;-)
Re: New Approaches To Designing Log-In Forms
#20I wouldn’t be happy, as a user, if I saw that information like this was made public about me on a site.