4

Assume you have a website that makes several checks on user-generated input. A few examples example from my current assignment:

  • the Belgian version of an SSN is validated using the user date of birth (first 6 symbols), the user gender (next 3 symbols) and a check digit (last 2 symbols).
  • An IBAN number is validated using the country code, the length of the number, the bank the account belongs to, the account number embedded in the bank, and a checkdigit.
  • A VAT number is validated using the country code, the length of the number and an algorithm that depends on the country code and usually involves a checkdigit.

I mainly wonder about 2 separate issues with this:

  1. The intent of these numbers is that the user enters a valid number. If the number is invalid, how much information should you show? Should you just show a generic "invalid input"? Should you give information on what exactly is wrong? should you go all the way and also give the expected value if you can figure it out easily? that last option sounds dangerous: what if the check that fails wasn't because the value it checks fails, but because the input that's used to validate the value was faulty?
  2. Often, if one of the early checks fails, the checkdigit check also fails. When the failure of a check is because of a wrong value in an earlier check, what check(s) should you show information for?
Improve this question

3 Answers 3

Reset to default
4

Lets think of the scenario, where a legitimate user and a malicious user typing in an SSN/IBAN/VAT number:

Legit User: There is a good chance that the user has memorized the number or written it on a piece of paper/text file. In this case, notifying a user that "The number you entered seems to be incorrect. Please check again." is perfectly enough. User will not be happy to know which of those algorithms has failed because of his miss-typed single digit.

Malicious User: If the message is less informative, the user will have to work hard. Otherwise he will figure out how to enter a false number which satisfies your algorithm.

I do not think you need to provide why your validation failed. Additional information will be useful for malicious users.

For something like an ISBN, if you can detect a single misspelled digit/character, it is okay to notify the user with something like this:

The ISBN code you entered seems to be invalid. Did you mean corrected_isbn_code?

But this is dangerous for a SSN/Passport number.

Rule of thumb: If the code is a public one (e.g. ISBN), it is okay to give a correction hint. If it is a private one (e.g. SSN), don't give correction hints.

You can also give constrained input boxes to your users. For example, if a particular number has 10 digits, and commonly formatted as XXX-XX-XXXX-X, you can make your input field to emulate that format (Add spaces/dashes, for example). This will be a great help to avoid miss-typings.

Improve this answer
4
  • 1
    I think if a malicious user wanted to generate a SSN/IBAN/VAT number, there are better option than trial and error on my website, since the algorithms that define these numbers are freely available online.
    – Nzall
    Aug 14, 2014 at 13:58
  • @Nate Still, think of your users: How they will know the number in the first place. Like I said, they'll probably have a piece of paper with the number written. So there's no need of that extra effort of thinking up elegant error messages.
    – sampathsris
    Aug 14, 2014 at 14:01
  • A user can always fat-finger a button. I think showing them what check they failed can help them realize their mistake faster, especially if the mistake actually is in a related field on the form, like the one that they use for their gender or their date of birth.
    – Nzall
    Aug 14, 2014 at 14:19
  • 1
    @Nate of course you have to notify individual inputs when multiple items get wrong. What I'm saying is that IMO there is no need to tell the user about validation algorithms for any particular field. Things like length/alphanumeric constraints are fine.
    – sampathsris
    Aug 14, 2014 at 14:31
1

For security reasons you don't want to give away the full formula of how the field is validated. However just showing 'invalid input' isn't really a useful phrase here. You wouldn't say that phrase in real life if someone said something wrong to you.

It depends how intelligent you want the message to be really. If someone enters a value that is too long then you can notify them that there are too many digits. If someone starts entering characters then you could notify them that the field can only contain numbers, that sort of thing.

But if you're after a more generic message then perhaps a better option would be to tell them what went wrong, but not the specific element, and then perhaps give then an example of what a (generic) valid response would be. Something like:

Sorry, that Social Security Number isn't recognised.
It should look something like: 88-4444-2222

It could just be that they've forgotten the format of their own number and have entered their National Insurance number in there instead of their Social Security one (or similar minor mistake). Showing them the format of what the value would look like should act as a trigger for their memory.

Improve this answer
0

Send your customers/citizens instructions by mail or e-mail. In your error message make a reference to these instructions, without giving any details.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.