When a user types their email address into a login form, I'd like to validate inline whether the email is associated with an account. The idea here is that, in the system in question, a large percentage of users will be sporadic and may not be sure whether or not they made an account previously.
However, I haven't been able to find any examples of websites that do this. I'm not terribly surprised, because my understanding is that a security best practice is to never validate login credentials separately; in theory, you're supposed to report "email + password not recognized" instead of just "email not recognized" or "wrong password".
That said, many respectable world-class websites (Google being an obvious example) do provide inline validation in the sign-up form. This suggests to me that it's perfectly easy to identify what email addresses have accounts associated with them, so why would I not provide that information in the login form as well?
So, my questions:
- Are there respectable websites that do inline validation during login?
- Is there an actual security risk to providing this validation?
- Is there a perceived security risk to providing this validation?
- I typically work under the assumption that the average web user isn't thinking too hard about security implications of form validation, but deviating from the status quo always has some risk.
(Since this crosses between web security and UX, please let me know if security.StackExchange or Stack Overflow would be a better place to ask this question.)