How to design the website password retrieve function

A few days ago I wanted to register for the Pub and found out that I had been registered before (which I often encountered). But can not remember the password at that time, and then tried to use its password to retrieve the function . Experience a return to the "classic" design experience of the "home" password.

What's the point of this input judgment?

Does it feel weird? According to the screenshot, I entered the username, the mailbox is correct, but why the prompt "username or email address wrong"? You can try it out on the Web site and understand the problem.

The reason is simple, the correct hint given in the figure above is simply that the input conforms to the formatting requirements. But in the click of the button, when the member name and email did not match, gave a false hint, more serious is that this error hint and the above correct hint contradict each other, is the wrong error hint. I thought it was fun to understand the mistakes made by the pub.

Password Retrieve function design is a very detailed design, but for users, this function is very important. Now different sites for password recovery processing are not the same, but generally should be the comprehensive consideration of these rules design:

• Password recovery functions are only valid for real account holders. For example, through several layers of account authentication, such as password protection issues.
• Easy and quick to get the user to retrieve the password, no user settings too much obstruction. For example, the phone to retrieve the password, not specific verification, directly to the password reset link sent to the registered mailbox.
• Give the user a certain guide when registering. For example, reminding the user that the mailbox is the only way to retrieve the password.

In addition, the password to retrieve the judgment process is in fact the test of the user's memory process, users need password to retrieve the time, it may be necessary to recall the registered user name, registered mailbox, password protection issues. I think as simple as possible, direct mailbox back on the line, of course, for different types of sites are different security considerations.