You’re at /login and type your username in the “Email/username” field. After the initial confusion I mentioned above, you click “Email me a one-time login code”. This brings you to the “Welcome back” page, where the “Email” field is pre-populated with your username (problem no.1). When you absent-mindedly click “Continue” you get three red messages all at once (problem no.2):
Incorrect username, email or password
Fix this error to continue - Email - Please enter a valid email address
Please enter a valid email address
The “Login with your password instead” text beside the next “Continue” button looks a bit like a description of the Continue button, but that’s not a big problem.
Then you click “Continue”. It goes to the “Welcome back - Check your email” screen, but the “Incorrect username, email or password” error is still there (problem no.3).
Here, the extra links (“Resend code”, “Use a different email address”) are below “Continue” and it’s clearer they’re something else.
Adding a note here to confirm that going forward, random username generation is not enabled by default along with this upcoming change, and is fully opt-in. The first post of this topic has been updated accordingly.
Personally I hate when verification or login mails have no links to click, so I would appreciate if you add an option to turn this as site preference.
having the email and the code as the first signup step is nice, but I wonder if entering an email (and sending a mail) without agreeing to data protection terms is acceptable? As already mentioned, it needs to fit into moderator approval (I.e. don’t send “activate your account” if that is not a given)
This is not an easy thing to satisfy, for two reasons. First, it’s best for the product to have one mechanism for confirming ownership of an email address. Having two mechanisms in place is confusing for end users, admins and our own support team.
The second reason has to do with security. A link can be more easily hijacked or manipulated by a potential attacker. For example, it’s easy for someone to send an email that looks like it’s from a legitimate site, with a link that also looks like it, but that instead takes the user to a different site or account. Links make social engineering attacks easier to implement. Email codes, less so.
Should be fine for a one-time email, no? I’m not sure how this is different when sending a link or a code, in any case.
Fix this error to continue - Email - Please enter a valid email address
Adding a note here to confirm that going forward, random username generation is not enabled by default along with this upcoming change, and is fully opt-in. The first post of this topic has been updated accordingly.