Page MenuHomePhabricator

Reword "password email has been sent"
Closed, ResolvedPublic

Description

MediaWiki:Passwordreset-emailsent, currently reads "A password reset email has been sent."

This can be confusing to users, because that message is ALWAYS returned, no matter if the email is known for this user or not (for security reasons). On VP/T I have multiple times seen that people 'think' they are entering the right email address, because it 'still works', but then it later turns out that they either didn't register an email address at all, or in reality had registered a different email address that they are no longer using.

Form: password reset form
Result of form:

Suggestion for rewording:
"If this email address is a registered email address for your account, then a password reset email will have been sent."

Details

Related Gerrit Patches:
mediawiki/core : masterReword "passwordreset-emailsent"

Event Timeline

TheDJ created this task.May 18 2015, 3:43 PM
TheDJ raised the priority of this task from to Needs Triage.
TheDJ updated the task description. (Show Details)
TheDJ added a project: MediaWiki-Special-pages.
TheDJ added a subscriber: TheDJ.
Restricted Application added a subscriber: Aklapper. · View Herald TranscriptMay 18 2015, 3:43 PM
TheDJ set Security to None.

+ Heather Walls (for voice & tone)

@TheDJ -

  1. could you please send a screenshot that indicates where this happens?
  2. Please clarify if "VP/T" = Village Pump/Technology
TheDJ updated the task description. (Show Details)May 19 2015, 8:47 PM

What is the pattern before they reach this point? Shouldn't it ask for the, "registered email address for your account" when they enter the address, and if it does, will the repetition help the situation?

TheDJ added a comment.May 19 2015, 9:15 PM

@Heather, I updated the description a bit.

Shouldn't it ask for the, "registered email address for your account" when they enter the address

It could, but I doubt the repetition will help. The point is that MediaWiki cannot tell the user if the address is correct, or if the user even originally registered an email address, but subsequently uses wording that suggests that it (the software) does know.

Is a more informative message possible? It still seems pretty confusing, and should be considered within the entire sequence.

Moving off Design Research board, but adding Voice and Tone tag

When/where was the discussion of the creation of the Voice & Tone tag?

Currently, you have to enter your UserName into the Special:PasswordReset inputbox, and MW checks if an email address is connected with that account. If not, it will show up an error message there itself.

But, I find that it shows "Password reset email has been sent" when the user had an email account set, but not confirmed. That is a bug, and the message needs to be re-phrased ( or additional check for isEmailConfirmed() done and return error )

Abhinand claimed this task.Aug 5 2015, 1:22 PM

Change 230284 had a related patch set uploaded (by Abhinand):
Reword Passwordreset-emailsent

https://gerrit.wikimedia.org/r/230284

TJones added a subscriber: TJones.Sep 23 2015, 7:57 PM

Looking at this as part of Gerrit cleanup day...

It's hard to come up with a good wording. Many sites check right away and tell you the email address is unknown. Of course, that's a potential privacy concern.

Do we have to claim that the email has been sent? Delivery isn't instantaneous, so is it okay to say it will be sent? It seems less awkward:

If the email address you provided is a registered email address, a password reset email will be sent.

or, reducing the repetition of email:

If the address you provided is registered, a password reset email will be sent.

Change 230284 merged by jenkins-bot:
Reword "passwordreset-emailsent"

https://gerrit.wikimedia.org/r/230284

Florian added a subscriber: Florian.Oct 8 2015, 3:40 PM

The gerrit change was merged, is this task resolved?

TheDJ closed this task as Resolved.Oct 15 2015, 4:33 PM