Does inline validation at login create a security risk or a perception of one?

Question

When a user types their email address into a login form, I'd like to validate inline whether the email is associated with an account. The idea here is that, in the system in question, a large percentage of users will be sporadic and may not be sure whether or not they made an account previously.

However, I haven't been able to find any examples of websites that do this. I'm not terribly surprised, because my understanding is that a security best practice is to never validate login credentials separately; in theory, you're supposed to report "email + password not recognized" instead of just "email not recognized" or "wrong password".

That said, many respectable world-class websites (Google being an obvious example) do provide inline validation in the sign-up form. This suggests to me that it's perfectly easy to identify what email addresses have accounts associated with them, so why would I not provide that information in the login form as well?

So, my questions:

• Are there respectable websites that do inline validation during login?
• Is there an actual security risk to providing this validation?
• Is there a perceived security risk to providing this validation?
  • I typically work under the assumption that the average web user isn't thinking too hard about security implications of form validation, but deviating from the status quo always has some risk.

(Since this crosses between web security and UX, please let me know if security.StackExchange or Stack Overflow would be a better place to ask this question.)

Answer 1

The only example I can think off of the top of my head is Facebook. If you try logging in with facebook with an email id which is similar to yours, Facebook logs you in automatically but with the Id which it thinks you were trying to login but to give them credit,it also asks for your password as shown below

I suspect they do it for only those systems which have the Facebook cookie stored or by IP addresses, but I have never got down to checking it.

Is there an actual security risk to providing this validation?

I would say yes because by this way, a person could easily determine the list of valid email ids which have accounts in this system and could potentially harvest those email ids for a number or purposes including spam. In a worse case,if any of these potential users have poor passwords, he could potentially break into the system.

Is there a perceived security risk to providing this validation?

I might be wrong but studies have shown that if users are comfortable with filling a response for a commonly asked question like an email id or name, they dont really notice the the inline validation message that comes across. To quote this article by Luke Wroblewski

In the first half of our web form, we asked questions people knew the answers to: first name, last name, e-mail address, gender, country, and postal code. In the second half of the form, we asked questions that were harder to answer correctly the first time. We had participants select a username (how could they know what was available?) and a password (with strict formatting requirements). It wasn’t surprising that we observed different behaviors in the first and second half of the forms.

Only 30%-50% of our participants saw the validation messages (Figure 2) in the first half of our forms—whereas 80-100% of our participants saw the messages in the second half. This is probably because people did not need or expect confirmation for correct answers in the first half of the form. Confident in their responses to these simple questions, most people paid no attention to the validation messages when they appeared.

in contrast, in the second half of the form, when our participants completed more difficult questions (such as username and password), they were less confident in their answers and therefore more inclined to seek confirmation. Also, they were more likely to hesitate, giving them ample opportunity to spot the validation messages (including those already on display in the first half of the form). The eye-tracking gaze path below (Figure 3), illustrates this behavior. The validation messages to the right of the input fields got a lot of visual attention in the second half of the form but none in the first half.

I also recommend looking at this question Is autocorrecting user login information a good idea? for more inputs.

Answer 2

Ok, I decided to add ANOTHER answer, rather than modifying the previous one, as I think I have a bulletproof solution for logging in, registration and password retrieval/reset. It's not that much user friendly, but is secure, as is based on seeing the validation info only by those, who have access to the registered email accounts.

1: Login form

Unfortunately, you need to forget about validating login (let's say it is email address). Validate only a pair: login and password with a very ascetic info that the pair does not match.

Below the login form, provide three links:

• I want to retrieve my access
• I want to register
• I don't know if I have access

After unsuccessful login attempt, do emphasize the three, suggesting password retrieval and checking access in the first place. User, who attempts to log in at least thinks he has an account, and we want him to gain back access to it rather than creating another, phantom account.

2: Registration

What makes the registration process insecure is validation of the email field. But you can avoid displaying the validation error on the page by using the following mechanism. Ask users to provide email address ONLY informing them that they will receive a link to continue the process of registration in an email message. This needs, indeed, more effort from user, but if you justify it by security reasons I think it will not result in high number of people leaving the registration process.

This makes the registration form more private. If a user exists in the database, you will send this information to the registered email address as well, providing a kind question if user wants to reset password and a link for it in the same time.

3: Password reset

You should only provide one field for email address. Once user enters it, he gets info in email message, and a proper reset link. If there is no such account, you can provide link to account creation instead.

4: Don't know if I have account

Again, provide just one field for email. In the message you send, user gets a link to reset password (if such user exists) or to account creation again.

Basically, 3 & 4 are almost the same, only the message text should be more supporting the actual user need. The same about the links below login form: I think it is necessary to provide separate links for 3&4 just because of different user perception of them.

I hope it better responds to your question; sorry for the previous answer, I really messed it up because of reading your question in a hurry and thus I did not provide 100% relevant information. And hence the second answer.