Hacker News new | ask | show | jobs
by laurencei 3331 days ago
I see companies trying to solve a similar issue on their password reset forms. They ask you to enter an email address - then give you a reply "if that email exists, we have sent a password reminder there".

The problem is these sames sites have a self-signup, using a unique email as your login. So you can already find out if an email address is in use or not.

If you've going to 'leak' the data one way or another, dont sacrifice UX for the sake of it.
3 comments
Xylakant 3331 days ago
Do the same thing on the signup page: If the email is already registered just progress the same way - send an email to that address and notify them that they already have an account.
link
shinratdr 3331 days ago
Which is great for most accounts, but what about a primary?

How do you sign up for Gmail without an email account in this case?

link
Xylakant 3331 days ago
well, obviously this will not work for a primary account. It also adds friction the signup process, leading to lower conversion rations. But for some use-cases that may be a valid trade-off. Think dating sites, ..., stuff where knowing that a certain email is subscribed already may be embarrassing or worse (gay dating websites in certain countries).
link
shinratdr 3331 days ago
Oh absolutely, it's a good system and many sites already utilize it.

I only mentioned the Gmail example because that's what the article was about, it sounded like you were suggesting a solution for that scenario.

link
lallysingh 3331 days ago
Use your shudder isp-provided one. Hello IAmBindingMyselfUnnecessarilyTo@comcast.net
link
cryptarch 3330 days ago
ISP email or any provider that doesn't ask for a secondary account, like Mail.com.
link
blincoln 3331 days ago
This is actually not difficult to address. Modify the account creation process so that the first step is to enter an email address. If the account does not already exist, an account activation link/code is sent. If it does, a password reset link/code is sent.
link
pavel_lishin 3331 days ago
> If the account does not already exist, an account activation link/code is sent.

That's not great for all use cases, though - if I'm just trying to check out of a store, I don't want to have to bounce to my email to confirm stuff.

link
JimDabell 3331 days ago
If you're just trying to check out of a store, you don't have to sign up for an account at all. Or if you do want to create an account, you can have it as an optional step after you've placed the order.
link
elif 3331 days ago
yeah but which signup form doesn't have a rate limit?
link