User had problems changing his password in /settings

[ckarlof]

From firefox-dev mailing list:

I have a firefox account, and this morning, I tried to change my password
using the website https://accounts.firefox.com/settings

This has three links viz. Change password, Delete account & Sign out.

Upon clicking on the Change password link, a new page appeared
containing two fields, one labelled old password, and one labelled
new password, plus a confirm button. I entered my old password
in the first field, and then the new password in the second field,
followed by clicking on the confirm button. The webpage then came
up with an incorrect password message.

I think the above webpage has a bug in it; normally, on all websites
that I am familiar with which allow changing of passwords, they all
have three fields, one for the old password, one for the new password
and a third for confirming the new password; the above webpage lacks
the last field.

After playing around with things, I went to the Firefox account sign in
page https://accounts.firefox.com/signin, and clicked on the forgot
password link. Upon receiving a reset password email from firefox,
this took me to a reset password, and which contained the confirm
new password field (as one would expect). So, there is a get-around to
the problem of changing my password, but clicking on the forgot
password link seems a pretty stupid way of doing it…

Could someone please look into this problem and fix it.

Incidentally, while I am here, I had a hell of a job contacting firefox
to report this problem. I tried clicking on the contact us link on the
firefox help page, and found this to be a circumlocution office (for
those who know their Dickens): there is no straightforward way of
reporting problems. Perhaps you could fix this too…

Steve Jones, a somewhat bemused firefox user

[ckarlof]

It sounds like he probably entered the password incorrectly in the change password form. We removed the confirmation field in favor of "show", but we should probably measure how effective this approach is.

/cc @ryanfeeley, @johngruen, @kparlante

[ryanfeeley]

The original Change Password design from June suggests that we pin the error to the relevant field:
https://www.dropbox.com/s/l018dkycn8baqaj/Change%20Password.pdf?dl=0
I still propose the same.

I have asked @kparlante to look into the current Change Password efficacy, as I'd prefer to reduce unnecessary re-entry.

[gnorcie]

@ryanfeeley: I can totally understand wanting to minimize text entry - and I want to emphasise that I think that is a very good thing to strive for.

My worry is that users do not know in advance they have mistyped their password. If that is the case, then a "show" button would be less useful than having them type the PW twice.

Keep in mind that most people remember their passwords through muscle memory, not visual memory. (For example, try to type your ATM PIN on the number row of a QWERTY keyboard. It's suprisingly difficult)

So if someone hasn't typed a password in ages and wants to visually see it to help trigger their memory, I'd think a show button would help. But if they were typing it the first time, I think there's a good chance they might mistype.

Would it be possible to try all the combinations and see which had the least issues? (Show, Confirm, Show+confirm)

[shane-tomlinson]

@ryanfeeley: I can totally understand wanting to minimize text entry - and I want to emphasise that I think that is a very good thing to strive for.

My worry is that users do not know in advance they have mistyped their password. If that is the case, then a "show" button would be less useful than having them type the PW twice.

Keep in mind that most people remember their passwords through muscle memory, not visual memory. (For example, try to type your ATM PIN on the number row of a QWERTY keyboard. It's suprisingly difficult)

Thanks for the input @gregnorc! You worded our shared concern better than I have able to since the Persona days. I like only typing my password once on signup, but while developing I have noticed that even though I use the same password most of the time, I mistype it once a day or so. The problem is exacerbated on mobile devices.

@ryanfeeley - An idea for A/B testing when we have that ready?

@kparlante - do we have any idea on the number of users who see an incorrect password on /signin that then go on to reset their password? The numbers might not be terribly high since only a handful of apps use FxA but it's nice to have a rough idea.