In early usability testing, I had a user click the Login button instead of Register and then try entering a variety of Email and Password combinations. Of course, they had not account.

I'm thinking that if they enter an invalid User ID (we use email addr right now) we'd say "there is no account with that ID, make sure your Registered".

I don't see this very often in other UI's though. And I suppose there's a risk that someone could try a zillion random email addresses until they get something other than "no user with that email".

I looked @ CheddarGetter.com, for example, and they don't do that. BUT if I click the "forgot my password" and then enter an invalid User ID it'll tell me then. So if it's safe to do it in the latter, it seems safe in the former.

  • 1
    It may be secure in the sense of not making your application more hackable, and still raise privacy concerns for the user. If you tell the user when the existing ID is correct, he can find who else has a login to your site. Especially unpleasant if you are building a porn site and a spouse looks up if their spouse's preferred login name is taken. But even in other situation, if you think that users won't want to hide that they have an account on your site, they might have reasons you didn't think of.
    – Rumi P.
    Feb 6, 2014 at 16:43
  • @Rumip, Excellent points. How would you handle REGISTRATION where they entered an email address already in use? Feb 7, 2014 at 18:00
  • There is no easy way to handle registration, but it is also not easy to use it for checking other people's accounts. Because, if the person in question doesn't have an account somewhere, the registration will go through and they will get a confirmation mail. Anybody will get suspicious if they start regularly getting confirmation mails from sites they never registered on.
    – Rumi P.
    Feb 10, 2014 at 10:07
  • @RumiP., yes. Are you suggestion that if someone tried to login or register with an active account ID (but failed) then we'd send an email to that person "FYI, An attempt was made to ...." ? That seems like a good middle ground of Ease of use and Security. Feb 11, 2014 at 16:42
  • I don't know of anybody who uses that practice. I meant that Alice does not know if Bob has an account as [email protected]. If she enters [email protected] into the registration form, she is aware that, if Bob did not have the account, he will get a confirmation mail and know he has been spied on. If Bob also gets a warning mail if a second registration attempt was made, this would be a stronger deterrent for Alice - if she knows that you are doing this. If she doesn't know it, the chance that she tries is the same as when you don't send it. And you will also confuse or (cont'd)
    – Rumi P.
    Feb 11, 2014 at 16:53

3 Answers 3


No no no no no. It's not safe at all. But for usability concerns you need to tell if the forgot password email was sent or not.

I for one use six to eight different email addresses and can't remember which one I used on each site. My account would be lost forever if I couldn't get the expected feedback if the account exist or not. But safe, no!


Here is the best way to handle this:

  1. User clicks "forgot login/password".
  2. User enters their email address.
  3. System sends an email to that user
    • If the user already has an account, inform them someone requested a password reset. If the user requested the change, click this link to reset.
    • If the user does not have an account, inform them someone attempted to login to the site but there is no account associated with that email. If the user would like to create an account, click on this link to register.

The advantage to this from a security perspective is that your system is not publicly displaying whether or not an account exists for that email address. It is "secure" behind the security of the user's inbox.

The advantage from a user's perspective is they just enter their email address into a single text box and press a single button and the email response they get gives them a single link to complete their task of getting access to the site.

  • There are certainly benefits to this approach. But the danger is that you are giving any attacker the ability to send an email to any arbitrary email address. One solution is to IP-limit to a few emails. But suppose that an attacker requests just one message – to a spam trap address. If he does that enough times, you may end up with email blacklisting issues.
    – N Rohler
    Apr 29, 2014 at 1:14

You are correct in your observations regarding inconsistencies in online security. To truly protect the identity of your users, you would need to do the following:

  • Never inform a user that they have the correct username (or email) but wrong password when they attempt to log in.
  • When creating a new account, never inform the user that credentials that are required to be unique (username or email address, whichever you're using) have already been taken by another user.
  • When the user goes to reset their password, always inform them that the "reset your password" email has been sent even if they don't have an account (and the user wastes time checking their inbox for an email that will never come).

The first point provides a poor user experience, but the other points are absolutely horrible. The "invalid username or password" pattern is followed partially out of laziness and partially for security reasons. By providing a good user experience while creating new accounts or resetting passwords, they've unwittingly leaked private information. There's no good reason not to help the user at this point.

Keep in mind that knowing where the lock is located is not the same as having the key for it.

  • Many online systems make the username publicly visible (such as on a forum)
  • Attempting to brute force a password for an online account is a very slow process (it is easier to compromise an account via phishing, social engineering, or by gaining access to the database itself)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.