Hacker News new | ask | show | jobs
by joshuahedlund 4648 days ago
From my experience, yes the site is really bad, and it's more than just heavy traffic.

The sign up screen lists some requirements for the username, but not all of them. My sign up attempt failed several times with a non-descript error message, which I attributed to the heavy traffic, until later I saw the "Forgot your username" page listed more requirements (apparently you can't end a username in a special character, which wasn't mentioned on the signup page, and which I only added at the end because that page wouldn't let me through without one)

So finally I signed up, but I get invalid login message every time I try to log in. Thinking maybe I mistyped my password (twice?) I clicked "forgot your password" and entered my username. It actually sent me a Forgot Password link to my email (confirming that I'm in the system) but when I click the link in the email it pulls up a page that says "We could find any account with the information you provided" - yes, with the information I provided from their own link. Have done that three times.

With these kinds of basic inconsistencies and bugs, I'm actually hesitant to enter my info once I do get in, wondering what kind of massive security holes are waiting to be discovered...

2 comments

> but when I click the link in the email it pulls up a page that says "We could find any account with the information you provided" - yes, with the information I provided from their own link. Have done that three times.

Frequently when I see that sort of thing it's because they're escaping/stripping characters out - often using myemail+tag@gmail.com will result in myemailtag@gmail.com or myemail%2btag@gmail.com and the resulting lookup will fail if it isn't de-escaped correctly.

The link has my username, not my email. It contains a period in the middle (again because I was require to used one). I looked up the URI encode for the period and replaced the period in the link in case it wasn't escaped right, but that didn't work for me either.
FYI, I was getting the exact same thing, and called the 800 number, and was told that there were specific issues related to my (ID) exchange and that they had techs working on it.

Sure enough last night I was able to get in with the credentials I signed up with.

I won't be signing up for any plans through it though, similar coverage would cost me about the same as what I pay now. Then again, my employer picks up 50% of my premium, so for some people it may represent a huge savings.