Why not sign up new users when an unknown email is entered into "forgot password"?

Question

On occasion I try to log in to a site that it turns out I am not registered with. I try to log in, get failed password attempts, and then click forgot password. At this point, one of two things happens:

1. I get a message telling the email is not recognized, or
2. I get a message telling me that if that email is registered, it will receive a password link.

Well, why not just sign me up when I do that?

I'm guessing there are good reasons not to use this as a design pattern, given that I've never seen it before and nobody seems to be writing about it. (I can't be the first to have wondered this.) But I'll ask the naive question: why not do it that way? Are there security risks? Unintended consequences?

The only thing I can think of is that you could sign people up for sites willy-nilly, but that's true of the signup page now. So, what else? It's not a dark pattern if the users' interests are well regarded.

Answer 1

In the first case (I get a message telling the email is not recognized), it's a security concern. One can brute-force the form with a list of emails and know which of them are in the system indirectly. Given the same list of emails, and a bunch of sites whose forms act in the same way, you can correlate, and infer user behavior. That's not good for privacy. That's why password reset forms nowadays will "always "succeed" regardless of the presence of the email in the system to avoid this.

The second case (I get a message telling me that if that email is registered, it will receive a password link) is a security feature. A reset email acts as a confirmation whether or not the owner initiated a reset by sending the next phase of the reset to a location only the owner knows. This assumes that the email wasn't compromised as well.

Well, why not just sign me up when I do that?

It only makes sense when the email isn't in the system. Why would you show a signup form with an email that's already used? This also means that form will have to make a determination when to show a sign up form based on the existence of the email. This makes it no different from the first case mentioned above.

Answer 2

The main problem here is that the user probably has an account already, under a different email address.

Sure, sometimes people use the "forgot password" system without actually having an account in the first place, but it is more likely that they forgot what email they used for an account, or mistyped the address. In this case they want to know that they have no account so that they can try again.

Duplicate accounts are undesirable for both you and the user. They defeat the whole purpose of having an account (storing the same person's information over time), and will probably lead to a lot of messes and support requests.

You definitely don't want to automatically register users for a new account at this point. You probably even want to avoid guiding the user into the new account process until options for recovering the account have been thoroughly exhausted.

Answer 3

It's likely if someone is using a "forgot password" link that they remember having an account on this site, even if they don't remember the exact email address used. So the bulk of users using it don't need a new account, they need their old account back (and will probably keep trying other email addresses immediately).

Answer 4

There are certain obvious things over here:

1. How will the authentication system confirm that you really are [email protected] without typing the password? Anyone may be knowing email address of a dozen of people registered over a website. So should anybody be allowed to login with anyone's email address. It may then forfeit the real purpose of putting the login mechanism at the first place.

2. How will you stop someone from signing-in when the email doesn't exist itself? One can type random alphanumeric sequence followed by @xyz.com When a password based login is put up then there are certain functionalities/actions/operations or information that we want only to be used by authenticated registered users.

A good practice is once the user comes on Forgot Password page then he or she should be asked answer of a secret question as set by him/her. Only when the correct answer is received then only the email should be send to Reset Password and then login with the new password.

Answer 5

Apart from the topics that have already been covered in previous answers, I'd add that signing people up who have not directly requested an account could result in legal issues.

For example, LinkedIn is the latest of many companies to be sued for a UX pattern that was viewed as deliberately setting people up to spam their colleagues and friends: http://www.fastcodesign.com/3051906/fast-feed/after-lawsuit-settlement-linkedins-dishonest-design-is-now-a-13-million-problem

A dishonest person could automatically enter a huge number of email addresses, and the recipients might conclude that it was an intentional decision on the part of the site's creators to get free advertising.

Some websites do let you know when you attempt to sign in using an email address that is not connected with a registered account. That's potentially a security concern but can be counterbalanced with other security measures.

Answer 6

People don't like it when web sites do things they didn't ask them to do...especially create new accounts for them.

Simply put, the expectation to forgetting a password is retrieving my password...not creating a new account for me. Actions should follow the expectations that are being set in the UI.