Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

I did.

I haven't logged int uservoice in a few months. So I was half guessing at my e-mail address and username.

Normally, when I don't remember, the error prompts on the log in page will indicate if I'm trying the wrong creds. Then I can try another set of creds.

But on this form, instead of telling me my creds didn't match anyone, it registered a new account with the e-mail address and username I entered and auto-sent me an e-mail welcoming me to uservoice. Ugh.

I tried it again with a different e-mail address, this time it matched the e-mail address against one in its DB and changed the username field into a password field before I could enter something into the username field. I took this change as an indicate that I'd found the proper e-mail address, entered in my password and was logged in. The whole experience was confusing and annoying though, almost as bad as the whole OpenID click-hear-go-to-another-site-read-some-legal-stuff-click-there-go-back-to-original site UX disaster.



So anyone can enter an email address and find out immediately whether it corresponds to a valid account, without having to enter a password or anything else?

Security FAIL.


Agree. But alas this is pretty common nowadays.. Try Groupon's login page, you'll get email address not found error with any unregistered email addresses




Consider applying for YC's Winter 2027 batch! Applications are open till November 2.

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: