Live data from Hacker News

Confirming Passwords Is Annoying: Is There a Better Way?

konigi.com

1–10 of 15 posts

Re: Confirming Passwords Is Annoying: Is There a Better Way?

#3
I simply don't confirm the password (or email). The overwhelming majority of people are going to type it properly, as substantiated by my failed login stats (less than 1%). For the remaining 1%, I'll concentrate on recovering from their error easily rather than depressing conversion among ALL users by making the signup form two fields longer. (And, ahem, if all of them were to get frustrated and abandon their trial, well, 1%.)

Edited to add: Context for why that number is so low: The vast majority of my trial users are up-or-out within 3 days, and since I default to setting a 2 week "remember me" cookie, typically only my most interested users ever have to type their password ever again.

By the way, you would be astonished how many users I have think they cannot type their school email address from their home computer and vice versa.

Re: Confirming Passwords Is Annoying: Is There a Better Way?

#5
post #2

If, first, we could rid the world of the many many sites out there that actually make you type your email or username twice, the world would be vastly improved. Not that the article isn't interesting.

That's what I thought, but on my site, I'd say about 5% of people make a typo on their email address. Now I am probably going to join the "confirm email" club.

Re: Confirming Passwords Is Annoying: Is There a Better Way?

#7
post #5
post #2

If, first, we could rid the world of the many many sites out there that actually make you type your email or username twice, the world would be vastly improved. Not that the article isn't interesting.

That's what I thought, but on my site, I'd say about 5% of people make a typo on their email address. Now I am probably going to join the "confirm email" club.

But does typing the email address twice, on the same form a mere 20 pixels from where you previously typed in full view of the previous entry, actually bring out corrections? If you mistype it the same way twice, you may not notice that you mistyped it, as both fields will look the same. For password fields, where the input is hidden/obscured, the double entry makes some sense (ignoring the UI issues/possibilities outlined in the OP), but with email addresses, it seems less so. I'd be interesting in hearing stats after you make a change.

Also, are the typos you've seen more often in the LHS or the RHS (of the @) in the email address? The RHS is relatively easy to spot check, by doing an MX and A DNS lookup to see if the domain exists -- you'll check actual delivery later. I've found this to be more robust than regular expressions that attempt to "validate" email addresses (see HN postings from earlier today) and assume a fixed size on the RHS, and are often overly aggressive in trying to detect "illegal" characters on the LHS, like +, which is not actually an illegal character.

Re: Confirming Passwords Is Annoying: Is There a Better Way?

#8
post #4

Ripped shamelessly from the comments on the post, I thought this was pretty neat: http://foxxtrot.github.com/Chroma-Hash/ However, I don't see how it's more effective than a callout or alert noting "these don't match" ... just less annoying and way sexier.

This has shades Lotus Notes hieroglyphics logins, but potentially much better.

http://www.coderjournal.com/2008/02/lotus-notes-aol-corporat...

http://www.encode-sec.com/pdf/esa0101.pdf

Re: Confirming Passwords Is Annoying: Is There a Better Way?

#9
Don't do #######

Don't ask for confirmation.

Solved.

(The ####### protects against someone peeking over their shoulder the exact instant they register, who wants to steal their password. It's not really very plausible and certainly not worth the hassle.)

Post reply on HN