Passwordless flow: What to do when user enters an invalid email when logging in

Question

I'm planning to make my app passwordless and I've seen sites implement things differently when one puts in an email they haven't actually used for an account on the site before when trying to login.

On Medium, if I put in a new email I'll get the message "We just emailed a confirmation link to [email protected]. Click the link to complete your account set-up."

This makes the signup process fast, but I'm not sure if this message is strong enough to make it clear to some users that this was a new email being used. This could frustrate users who had forgotten which email was used for their existing account and would now take the time to realize they're using a new account before trying to login again with the right email. However, that scenario may not occur often enough that its worth designing the UX to prevent it.

Zeit does design things so if I don't have an account and I put in a new email I'll get the message "There is no ZEIT account associated with this email address. Continue with signup?" and I can click to signup.

This prevents one from realizing they used the wrong email, but it adds an extra step to signing up and I think it could confuse users who weren't paying attention to the fact that they clicked login rather than sign in.

What do you think is a better flow and why?

Answer 1

I believe this is a usability / privacy tradeoff scenario – where the most user-friendly option actually sacrifices a bit of privacy / security for your app as a whole.

There's a more detailed answer on this article at Security Stackexchange, but I will try to summarize here:

If you verify that an Email address is used for an account on your application, it would allow someone to know if a given person is using the app, just by knowing their email address. Meaning, if I know your Email, I can check and confirm that you belong to "scifi-fanatics.com." This is a general privacy concern, but is more serious (and could potentially be illegal) if your app involves legally-sensitive information, such as health-related services, which must legally be kept private / anonymous.

Answer 2

I agree that this might be an unlikely scenario, but still, it's good to prevent it, especially since those that login more often, are more likely to experience it, thus affecting your most loyal users.

Have you considered using something like the Gravatar's API to show an image related to the email being entered before they even proceed with the signup? It might become a hint for the user that they might have typed in the wrong email, as most will have a profile picture associated with it.

Answer 3

I think in this case, harder authentication but more secure is better than just easier sign in / sign up for average users who can't save themselves from privacy concerns.

Put security above usability in most cases like this!

Answer 4

Our (very niche) website allows anyone to create an account when we send a unique link in the body of a message to the specified email.

Our choice has been to let people accidentally create duplicate accounts, since we believe that responding to that email is a sufficient warning. This despite the fact that our target audience includes people who still have landline phones and who confuse web browsers with email tools. A few extra accounts seems a small price to pay for the simplicity of the interface.

I also endorse @Luke's response.