Form states

Currently

If someone enters only a Rochelle here in username, and that account requires both fields, they should see…

For users who require both

Messages

As noted by @ifried we shouldn’t tell people if the username doesn’t exist, same as we do with the email.

Currently the messages are as follows:

Once we add the setting, all the messages would remain the same for people who don’t have it enabled. When the user has it enabled, and only one of the fields is entered, they’ll go to the Required password reset form shown above. When both are entered we could show:

If this email address and username are associated with each other, then a password reset email will be sent.

What do you think @ifried?

Related T231585: Design: Determine Messaging for Users After Special:PasswordReset

@Prtksxna Thanks so much for these proposals! They have sparked some really interesting conversations, and I would like to share two follow-up questions as a result:

• What do you think about including a more vague message at the top (which gives less information to harassers). For example, at the top of Special:PasswordReset, we can display a message like, "Both username and email address are required." That way, the harassers don't know (or are less likely to know) that a particular user is actively trying to curb harassment. Meanwhile, good faith actors will still get the information they need.
• One alternative idea was proposed, which is: We don't ever inform the users that the email address or username are required (when the preference is enabled). Instead, the message (after the request has been generated) will have an additional sentence that says something like, "This account may have enabled the preference to require both username and email address in order to request a password reset" (or something along those lines). This proposal was mentioned because it would give less information to harassers. However, I'm inclined to think that this option isn't the best choice. This is because the same issue we have previously discussed (i.e. frustrating good faith actors who wish to reset their passwords) will persist, especially because people may ignore such messages.

What are your thoughts? Thanks!

In T231485#5477312, @ifried wrote:

• What do you think about including a more vague message at the top (which gives less information to harassers). For example, at the top of Special:PasswordReset, we can display a message like, "Both username and email address are required." That way, the harassers don't know (or are less likely to know) that a particular user is actively trying to curb harassment. Meanwhile, good faith actors will still get the information they need.

You mean that we use this message on the second form, right? Replacing the text, "This account requires both email address and username to send a temporary password via email" to something like "Both username and email address are required."?

This suggestion is better, I agree. It would inform the good faith users, and confuse some harassers. The seasoned trolls however will figure it out either way.

• One alternative idea was proposed, which is: We don't ever inform the users that the email address or username are required (when the preference is enabled). Instead, the message (after the request has been generated) will have an additional sentence that says something like, "This account may have enabled the preference to require both username and email address in order to request a password reset" (or something along those lines). This proposal was mentioned because it would give less information to harassers. However, I'm inclined to think that this option isn't the best choice. This is because the same issue we have previously discussed (i.e. frustrating good faith actors who wish to reset their passwords) will persist, especially because people may ignore such messages.

This is a larger question (which as you mentioned we've already kind of decided on) — We always give information to help the good faith user, even if it inadvertently gives a clue to a bad faith actor.

I think it makes sense since we have more good faith resets than bad faith ones (I think I am assuming this, is there any way to get data on this?). I am happy to look at more troll the troll workflows if we want to take another look at this decision.

Thanks so much for your feedback, Prateek!

1. I'm glad we agree regarding ambiguous instructions. I've written up a ticket (T232512) that includes this instructional language. Also, do you think it would be possible to update the mockup with the new language? If so, I could add the new mockup to the ticket.
2. I agree -- this approach isn't ideal, in my view. Like you wrote, we made a decision to prioritize information for good faith users. For this reason, I don't think additional troll workflows are necessary (though thank you for offering!). I just wanted to share this idea because we hadn't specifically discussed it (and it came up in a meeting yesterday). So I just wanted to quickly check in to see what you thought.

In T231485#5480229, @ifried wrote:

1. I'm glad we agree regarding ambiguous instructions. I've written up a ticket (T232512) that includes this instructional language. Also, do you think it would be possible to update the mockup with the new language? If so, I could add the new mockup to the ticket.

Sure, I've added the updated mockup there, and added a requirement to add the required icon () on the input fields.