4

When the user enters a valid email on the login like Google did some time ago, is there any problem to show the avatar?

Does make the experience better?

Is a there is any security risk?

1

This would be bad from the security point of view. Anyone will be able to enter any name and see if this login (if this person) is registered at this site.

Suppose you enter the name of your neighbor at some web site that sells drugs or weapon and see his picture. This would mean he is registered at this web site (unless it is a fake account). This would be a huge security problem because it discloses personal details of this person without knowing his/her password.

I'd suggest you don't display avatar until user is logged in.

To user experience:

  1. If because of security reason you don't display it, then there is not much sense to discuss UX.
  2. Even if you would display it, the users would think "Holy s...! They don't care about my security! What else security problems they have?"
  • I'm not saying it's a good idea to reveal something from the username/email only, but re. point (2): I suspect the vast majority of users who think anything at all would think "Aww, cute! It's remembered who I am!" – TripeHound Jul 19 '18 at 13:44
0

In the case of a legitimate user signing in with their email address, this can be helpful.

There's a privacy question you should consider: if I wasn't the legitimate user owning the account, and I was just trying to snoop on someone else by entering their email address into your service, would the legitimate user be pissed off? They may not be, for example if it's already possible to look up your users' profile by email address using some kind of public search form. But if there's a chance that they will be annoyed, or if you're not sure, then sounds like a bad idea. You can somewhat guard against this case by doing it only if the user has previously signed into the same account in the same browser but this can add quite a bit of complexity.

It may also not be very valuable. In the case of Google, it helps users who share a single computer between multiple users, because it's easier to choose from a short list of accounts when their profile photo is visible than when just their email address is shown. But Google only has this problem because it has so many users that some of them end up in the same household sharing the same desktop computer, repeatedly signing in and out of the same accounts all the time. If your service doesn't have this case to handle very frequently (e.g. if most browser sessions that sign into your service only ever sign into one account) then this could be overkill.

  • The privacy will be violated. It would be easy to check if smb. has an account at some bank, if he works at some company, if he is using a particular service provider. Your statement about multiple Google accounts and household is strange. Any OS (Win, Mac, Linux) supports multiple user accounts. I don't know anyone who share computer/laptop and use the same system account. And the most important: Google does not show avatar after entering user name during login. Google remembers in cookies who was logged in. But this is has nothing to do with the question about login above. – mentallurg Jun 19 '18 at 21:56
  • @mentallurg of course if the service is a bank (which isn't mentioned in the question) it would be a bad idea, but otherwise I don't think you can say for sure that someone's privacy will be violated, e.g. if the service otherwise already allows looking up members some other way. For example on github you can search people by public email, so for those users who have set their email public you wouldn't be revealing anything new. – qoba Jun 19 '18 at 23:07
  • @mentallurg re "I don't know anyone who share computer/laptop and use the same system account." Again not something that most services have to worry about but sorry to disappoint, there are plenty such users... – qoba Jun 19 '18 at 23:09
  • If accounts are public any way and avatar is visible to anyone without login, then I agree, that would be OK. Then what is the sense to displaying avatar at the login dialog? – mentallurg Jun 19 '18 at 23:10
  • @mentallurg it's relatively low value but it can help users realize earlier if they've made a mistake typing their own email – qoba Jun 20 '18 at 0:40

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.