On occasion I try to log in to a site that it turns out I am not registered with. I try to log in, get failed password attempts, and then click forgot password. At this point, one of two things happens:
- I get a message telling the email is not recognized, or
- I get a message telling me that if that email is registered, it will receive a password link.
Well, why not just sign me up when I do that?
I'm guessing there are good reasons not to use this as a design pattern, given that I've never seen it before and nobody seems to be writing about it. (I can't be the first to have wondered this.) But I'll ask the naive question: why not do it that way? Are there security risks? Unintended consequences?
The only thing I can think of is that you could sign people up for sites willy-nilly, but that's true of the signup page now. So, what else? It's not a dark pattern if the users' interests are well regarded.