Data Validation - Positioning

Question

I have discovered that users are struggling with signing into our site due to data validation.

Currently, the system has this logic:

• Wrong email/ID = display error
• Wrong password = display error
• Wrong email/ID/password = display error

This error is the same for all instances and displays underneath the email input box regardless of what is causing the error.

My question is, should I split out the error box to say 'Incorrect Password' and display this under the password input in the instance the user has entered the wrong password (to make it clear this is what the user has to correct before continuing)?

I had a secondary thought which was if someone is trying to log into someone elses' account, they would have confirmation that the email they guessed is correct but the password is wrong or vice versa.

Do the positives of solving user struggle outweigh the potential issues around fraudulent behavior?

(Basically asking the question as I predict stakeholders will ask!)

Answer 1

Are you validating with an ID besides the email and the password? If that is the case, then the system is quite secure and you should not be worried about unauthorised usage.

Most of the time when users do not remember the password, they would try the 'Forgot Password' feature. Which would then be validated via email or phone number. The key to this, however, is the speed. If there is quite an amount of delay in receiving the validation mail or phone code, users will give up.

Answer 2

That depends on how secure your site needs to be, and who are your users, I am not a cyber security expert, this is a UX forum and in terms of UX, I would guide the user to have the easiest login process as possible.

google for example, changed the login flow in to gmail, so that you enter your email and only if it exists in the system, it will ask you about your password, otherwise it will tell you that the email address does not exist.

And anyway, when you forget your password, if your user does not exists in the system, it will tell you, so why won't the system inform about it in the login stage..

You can also try to understand why exactly people fail to log in, and provide them with relevant tools, like an easy password recovery.

Answer 3

If the error always displays under the email text field that always indicates to the user that their ID or email is incorrect and not their password. If you have the same error message for all errors it should be above the form fields. As Eran said, there are good UX examples to solve this, such as Google did, but it depends upon the security needed for the site.