27

We have been seeing more sites following this UX enhancement: where login form actively checks for registered username/email, if a user entered an unknown email/name, then the form inputs are updated to allow new user registration seamlessly.

Assuming such design can be implemented with proper fallback when javascript fails, are there any arguments for or against such pattern? Also, is there a name for such pattern?

by default show login

change to signup form if user not found

Improve this question
6
  • For what it's worth, if I wanted to sign in or register on your site and saw that login form, I'd immediately click either the Facebook or Google logo, regardless of whether I previously had an account on your site or not.
    – Ajedi32
    Sep 9, 2014 at 20:49
  • @Ajedi32 - are you saying that because you wouldn't "trust" it, or because it isn't clear how to join any other way, and once you have joined using "Facebook" for example, you'll always have to login at "Facebook" anyway.
    – Kevin Fegan
    Sep 10, 2014 at 5:31
  • Xenforo does it in a interesting manner: A single "sign-up or login" button, which opens a form asking for a username, a checkbox if A) the user already has an account or B) wants to register. Below it there's the password field, which only appears if option A is selected. The submit button also changes its label accordingly.
    – Kroltan
    Sep 10, 2014 at 8:50
  • 1
    Closely related: ux.stackexchange.com/q/11840/2131.
    – TRiG
    Sep 10, 2014 at 9:42
  • 2
    @KevinFegan Because if I did have an account it would be the quickest way to sign-in, and if I didn't I'd expect it to create one for me. I might not even remember whether I have an account or not, I'd expect the website to remember for me and take action as appropriate.
    – Ajedi32
    Sep 10, 2014 at 13:22

3 Answers 3

Reset to default
30

I think the strongest argument against this sort of pattern is simply, "How does the user know?"

How does the user know that they can register simply by attempting to log in. If they know they have never signed up for this site, they know they do not have login credentials. Thus they will actively look for a sign up option.

The sign up option is a long established web trend. Something our users are used to.

If we redesign and attempt to implement a new trend, we instantly confuse our user. We can't just flick that switch overnight.

Typos

...and if the user makes a typo when signing up? They've just created a new account for themselves. Great! No second chances, unless they feel like hitting the back button and starting again.

TL;DR

If it aint broke, don't fix it. A normal login with an evident CTA to sign up works fine. By attempting to streamline an already efficient process we run the risk of confusing users, which is the one thing we never want to do.

Improve this answer
6
  • 5
    Welcome to UX.SE. Your main point seems to be that's the way it's always been done. Do you have any experience to add? Do you have any sources to back up your assertion that the existing system isn't broken? Also, "If they know they have never signed up for this site, they know they do not have login credentials." That's a big if. There are thousands of sites that I have registered on at some point and I don't remember most of them. Your statement raises an interesting question about whose responsibility it is to remember. I would put it to you that it depends on the type of site.
    – m-smith
    Sep 9, 2014 at 12:46
  • Aye, an admittedly short answer. I'll flesh it out when I get some time later.
    – omcgo
    Sep 9, 2014 at 13:14
  • 2
    There are cases where I know that I am registered, just don't know username/password. So I would want to try multiple login attempts, and not create a dozen new accounts along the way.
    – Alexander
    Sep 10, 2014 at 7:25
  • @Alexander That would be easily solved by adding a "Hey, you are new here, would you like to create an account?" message. SE does it similar. If I try to log into a new site, I can create and connect the account; sign up does exactly the same.
    – musiKk
    Sep 10, 2014 at 9:24
  • 1
    I could just as well argue "How does the user know filling in their credentials in the login form won't create an account for them automatically?". As for the typos, simply entering your information wouldn't create an account on its own; it should still be confirmed by email. Arguing not to change something simply because it is a change is not a valid argument, imo.
    – devios1
    Sep 12, 2014 at 21:11
7

I think this is a nice UX, but there may be security & privacy concerns. Being able to enter someone's username/email and know whether they have an account may be a breach of privacy and could lead to a security vulnerability.

Improve this answer
5
  • 4
    While I am not a fan of the proposed UX, it's not really a significant security/privacy concern. A new user will always have to know if their desired username is already taken. In most cases, going directly to the register/signup page, will let you test if a username is available or not, and will usually complain if you try to create a new account with an email address associated with an existing account.
    – Kevin Fegan
    Sep 10, 2014 at 5:24
  • 1
    A new user will only have to know if their desired username has been taken if the site enforces unique usernames @Kevin. Not all do (this one for instance)
    – Ben
    Sep 10, 2014 at 12:08
  • 1
    @KevinFegan It's more an issue for email addresses. You are right that usually registration forms will tell you if an address is in use. It could be avoided to disclose the address though by sending any further instructions or warnings to that address instead of showing them on the website. For the proposed UX i don't think this would work.
    – kapex
    Sep 10, 2014 at 12:35
  • I felt the need to comment to confirm non-uniqueness of names here (I'm not the person who posted the answer), therefore there is no real security concern. Also, there could be some limit to stop automatic checking of valid e-mails in conventional sign-up form. But then again, there are enough login forms that don't use that mechanism (or at least I've stumbled upon a lot) to assume that, if you can provide solid protection, it's not a big security risk.
    – Luke
    Sep 10, 2014 at 18:11
  • 1
    This is a valid point. However, it could be done in such a way that attempting to sign in with invalid credentials would show the same response on screen as creating a new account, something along the lines of "Unable to sign you in with these credentials. If you don't yet have an account with us, check your email for an activation link". Moreover, it could alert a user that someone has attempted to sign in with their credentials if they do already have an account.
    – devios1
    Sep 12, 2014 at 21:15
2

I am implementing something similar; this is my approach, and more a reply to @omcgo (https://ux.stackexchange.com/a/64134/39632) than to the original question.

mockup

download bmml source – Wireframes created with Balsamiq Mockups

In this case, when the user first starts the login the Register section is hidden. If the user tries to log in, and the email isn't found, the form will change the Login button to Register, the Register link to Login, and hide the Social Login section, while showing the Register section. If the user clicks "Register", the same flow happens.

If there is an account, and the password is wrong, the standard "Invalid Password" prompt appears. The backend service is rate limited at one request per email per second, and recaptcha appears after three wrong attempts. (This is not a bank.) The Reset Password link is shown here.

Finally, for power users, simply changing the email while in the register section simply tries the login again.

I think this works with the original goal of a "new" login/register flow, while covering the bases for the "old" login page, register page flow.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.