I expect people have to type in passwords pretty regularly. Sometimes if you haven't typed it in for a while but end up faced with a login prompt, you think you remember the password, type it in, and see what happens. If you receive an error prompt ("incorrect password", or similar message) you either type the same password again (you think you must have made a typo), or try one of your other passwords (assuming people have a series of older and newer passwords that they use from day to day). In this scenario, being faced with an error message isn't uncommon -- you just move on to the next password, or re-type your password.
I have recently noticed that an on-line retailer/service provider ALWAYS returns "incorrect password" if it is the first time that you log in using a new app/browser/device, even if you typed the password correctly in the original login attempt. I suspect that they do this to thwart automated password attacks. Even if the user's password was compromised, the (automated) attacker is less likely to try it twice -- instead thinking that the user has since changed their password and that this password is no longer valid.
I have only recently started to use a password manager, and for the first time I could confirm that this service provider does this (given that the password manager is guaranteed to have entered the correct password). Simply entering the password again (asking the password manager to fill it in again), along with solving a (now additional) captcha puzzle, granted access.
So, my question: do people expect to mistype their passwords? Has anyone performed any studies in this regard? Is it (failure/mistakes) so much a part of the authentication experience that leveraging it to thwart automated password attacks "acceptable"?
I suspect the reason that the provider "gets away with it", is because the password is (eventually) stored by the local application/browser, so subsequent login attempts from the same machine/device does not trigger this behaviour. The worst-case scenario (from a user perspective) is that you were sure that you typed the password correctly the first time, then never type it in again (maybe you try a variation instead), and end up resetting your password. The account is never compromised, but people just reset their passwords often. The odd part is that they blame themselves for getting it wrong in the first place, so don't direct any negativity to the service provider.
I have not encountered anything like this from other sites/service providers before, but could replicate the results with the help of some friends that use the same service.
Just to be clear, I know that there are better ways of dealing with the authentication process. My question pertains to the expectation of the user, and people's attitude to making typos in their passwords.
EDIT: This also points to users' implicit trust of systems. If a system says the password is wrong, it must be "telling the truth", correct? Systems never "lie" about passwords. I just find it really interesting that people think this way. I never thought differently, until I noticed it being exploited by this service provider (with millions of users worldwide).
EDIT 2: I agree that it isn't "normal" to do this, but the question is not about if this is right or wrong, but instead what people expect to happen at password prompts. How often do people mistype passwords? And if it is often, do they expect it to happen? And if they expect it to happen, then it perhaps isn't such a terrible idea to leverage this loophole in user expectation to solve another problem. But first, how do users perceive their password entering ability? How do you know that?