0

Suppose that a new user goes to register on a site and enters an existing e-mail address. What message should be presented to that user from a UX point of view? Bear in mind that in the above case(as I see it)...two type of users might do the following:

  1. An already registered user who just wants to see what will happen if he attempts to register(that is one thing I possibly can imagine).
  2. A malicious user who knows the e-mail of another person and tries to find out if he/she is registered on the site.

How can I deal with the above cases? Of course I cannot know in advance which type of user goes to fill the form. So I am trying to find a message that will cover both of the above cases.

What do you suggest?

2 Answers 2

3

There are numerous cases that a user already has an account but forgot. It happens all the time.

Have proper messaging telling the user that the account is already registered.

Even if a user is malicious and wants to know if an email is registered, that is absolutely fine. That is why we have passwords to begin with, so those malicious users can't get in without the credentials.

The login is where you have safeguards in place (max 3 attempts before 30 minute wait potentially).

1

In a situation where even the email address of users should be protected (I can think of numerous sites where this may be important), you could:

  • Let the user complete the first step of registration = provide email address + password
  • Always display a message on the page like "We have sent you an email message. Please follow the instructions in the email to complete your registration".
  • The email message can be of different flavours:
    • "everything OK, click here to continue"
    • "We already have a registration with this email address. Click here to reset the password."

PRO: Malicious users cannot find out who is registered (unless they also have access to the email account of their target)

CON: Hassle for legit users, who have to jump to email and back to register. Possibly leading to many legit users not completing registration at all.

So I would recommend this approach only if anonimity is such a big deal that the pain of 1 malicious user finding out if someone else is registered is greater than the pain of 1000 legit users you send through hoops to register + the pain of the x% legit users who will abort registering with you.

2
  • I think this is too much work for the user to get a simple "account already registered." Take google for example, they will tell you outright that an account exists, PLUS show you an image (something that even could be personal). Where it falls through for malicious users is google sends the user a message letting them know someone was accessing their account.
    – UXerUIer
    Commented Oct 5, 2016 at 16:03
  • I agree that in many cases, this is too much work for the user. For many "normal" sites like Google, it is not worth the effort. But for specific sites (think cheat-on-your-partner like websites) this may be worth it. That is why I included caveats in the answer, see last paragraph.
    – wintvelt
    Commented Oct 5, 2016 at 16:57

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.