483707 - Website: change copy for forgot password page

Status: VERIFIED FIXED

(Mozilla Labs Graveyard :: Personas Plus, defect, P1)

Description

[David Rolnitzky]

Copy wasn't changed in Bug 482627 (comment #5).  It should be:

"Oops!  We are unable to locate the username you entered.  Please try again, or
create a new one."

Comment 1

[Myk Melez [:myk] [@mykmelez]]

Note: for security, it's generally better not to let users know whether or not a given username exists on a site, since doing so makes it easier for account attackers to focus their attacks.  So we probably shouldn't be revealing the nonexistence of the username here.

Comment 2

[David Rolnitzky]

How about this approach:

"Oops! The e-mail address and password you entered do not match any accounts on record.  Are you trying to register for a new account?"

Link "new account" to the signup page.

Alternatively, flickr, as an example, uses simply:
"This ID is not yet taken.
Are you trying to register for a new account?"  Which seems to be the original approach.

Comment 3

[Myk Melez [:myk] [@mykmelez]]

(In reply to comment #2)
> How about this approach:
> 
> "Oops! The e-mail address and password you entered do not match any accounts on
> record.  Are you trying to register for a new account?"

Since this is from the Forgot Password page, they haven't entered a password at this point, so we can't say it doesn't match.


> Link "new account" to the signup page.
> 
> Alternatively, flickr, as an example, uses simply:
> "This ID is not yet taken.
> Are you trying to register for a new account?"  Which seems to be the original
> approach.

That actually has the same security implications as the original text: it reveals whether or not the username is in use.

But perhaps this is a security risk we're willing to take.  I notice that addons.mozilla.org also reveals this information: when you enter an email address into its Password Reset form <https://addons.mozilla.org/en-US/firefox/users/pwreset> that doesn't correspond to an existing account, the site responds "User not found!".

So perhaps it's ok to report an error when we can't find the username the user entered, and the text in comment 0 is fine.

Comment 4

[David Rolnitzky]

Given the precedent here with other mozilla properties, let's stick with comment 0 for now.  Thanks for the feedback Myk.

Comment 5

[Ryan Doherty (:rdoherty)]

done.

Comment 6

[Stephen Donner [:stephend] Not actively reading bugmail]

Attachment: Post-fix screenshot

Comment 7

[Stephen Donner [:stephend] Not actively reading bugmail]

Verified FIXED on https://sm-weave-proxy01.services.mozilla.org/forgot_password.