Try to sign up with an existing account throws no error

[mzorz]

If you try to sign up with an email address that already has an associated account on Simplenote, it will fail silently, saying you should get an email but you don't get any emails.

Expected

An error should appear saying sign up with the account is not possible because an account with that email already exists, or at least say "if there's no account with this email address, you'll receive an email.. etc etc"

Observed

User sees this screen

But gets no email

Reproduced

1. tap sign up
2. enter an email you know has an account
3. observe the screen
4. observe you don't get any emails

[dangermattic]

Thanks for reporting! 👍

[theck13]

If I remember correctly, I think this was intentional. We didn't want to give bots and/or hackers any insight about whether an email address has an account or not. If we did, they could use signup to determine if an account exists then use login by credential stuffing with more certainty. That's probably why we chose the "Didn't get an email? You may already have an account. Contact support@simplenote.com for help." message so it's much harder to automate an attack. Something like "If there's no account with this email address, you'll receive an email..." is pretty much the same thing as "Didn't get an email? You may already have an account." to a human, but it's not as easy to understand for a bot.

[mzorz]

Oh I see! That makes a lot of sense. I'll close this issue then 👍 Thanks a lot for the context! 🙏