We will be rolling out a new, fully re-factored and redesigned login & signup pathway on Meta tomorrow morning, just missing Marc's estimate of 6-8 weeks back in October.

As many of you are aware, our current design has been around for years. To keep everything secure, we had to use iframes and redirect users to openID.stackexchange.com during parts of our sign-up process.

We've known for quite a while where we wanted to take the design, but we were waiting on SSL functionality to make it work.

What you'll find in the new version:

  • End to end SSL
  • A simplified design placing the services that 95% of our users need front and center ( Don't worry, all of the old services are still there. Except MyOpenID. It's still dead.)
  • No more redirects to openID.stackexchange.com for email verification or account recovery
  • Shorter, and separate, pathways for signup and login that don't use iframes.

We hope this new design will be easier and less confusing for new users and quicker for existing users.

Since this is a full refactor, it's likely we've missed some edge cases during internal testing. We would be very appreciative if you guys could kick the tires a little and let us know if something doesn't look right.

Please post requests and bug reports in this thread until we rollout network wide.

The new login and signup pages have now been rolled out on Meta - do your worst!

  • So presumably, this means no more weirdness with HTTPSEverywhere and logging in, then? Since it means SSL is end-to-end.
    – Makoto
    Commented Jan 14, 2014 at 19:56
  • 3
    @Makoto The word from the dev team is it'll be less likely to break, but it will still be officially unsupported
    – Jeremy T
    Commented Jan 14, 2014 at 20:01
  • I currently use OpenID on my own domain, delegated to MyOpenId. (I have backup logins, so I've not bothered changing that.) I hope that the "enter your own domain name" option doesn't get too badly hidden.
    – TRiG
    Commented Jan 14, 2014 at 20:08
  • 1
    @TRiGisTimothyRichardGreen It will be the same one click away that it used to be.
    – Jeremy T
    Commented Jan 14, 2014 at 20:09
  • Is this tomorow morning UTC, or tomorow morning Eastern (US) time?
    – hichris123
    Commented Jan 14, 2014 at 20:49
  • 3
    I'm curious if HandleSuccess is still around in the new pathway?
    – GSerg
    Commented Jan 14, 2014 at 20:59
  • 1
    @hichris123 Likely very early morning Eastern time
    – Jeremy T
    Commented Jan 14, 2014 at 21:19
  • 13
    @GSerg Nobody was brave enough to re-factor HandleSuccess
    – Jeremy T
    Commented Jan 14, 2014 at 21:20
  • To be fair, Marc used the phrase "Real Soon Now™", not "6 to 8 weeks". I may have equated the two, but apparently "Real Soon Now™" can cover a slightly longer period of time! Commented Jan 14, 2014 at 21:42
  • Shouldn't that be tagged [featured]?
    – juergen d
    Commented Jan 14, 2014 at 21:46
  • Not really featured till tomorrow, I figured.
    – Jeremy T
    Commented Jan 14, 2014 at 21:47
  • @JeremyTunnell Might get a little more visibility before it gets rolled out though. Commented Jan 14, 2014 at 21:59
  • 2
    Might even be worth a blog post in my opinion. Commented Jan 14, 2014 at 22:57
  • 1
  • 2
    Is the code still opensource? Interested in having a security code review?
    – AviD
    Commented Jan 15, 2014 at 22:32

8 Answers 8


Trying to sign up with an email that's already registered fails with a useless error:

An error occurred with sign up. Please try again later.

Note that on openid.stackexchange.com, trying to register an already-registered email address tells you this explicitly:

Email already in use.

I would expect at least the same behavior from the integrated signup.

  • 3
    You also get no feedback for incorrect password or email not found. Commented Jan 15, 2014 at 20:54

It would be nice if the distinction between the Google accounts and Google profile accounts (in the second tier of options) could be clarified.

I was also disappointed to see the Yahoo! option demoted to the "More login options" tier. It now occupies the space once held by myOpenID. I hope that's not an omen.

  • 2
    I'm not surethat it's possible to make more of the distinction between the Google accounts for the reason that I don't think people actually understand that there are different Google accounts. Our approach is, if you have a Google account, there's a 90% probability that it's the one that we made the default. If you're one of the few people that have the other type, then it's more likely that you know the difference. WRT the Yahoo placement, It's just a small and declining percentage of our sign-ups, and the added clutter with another button just wasn't worth it.
    – Jeremy T
    Commented Jan 15, 2014 at 18:36

On /users/login when selecting the Stack Exchange login leaving username and password empty and click on login the message 'email cannot be empty' appears which is good. Not good is the closing of the dialog ending up in this UX:

Can the dialog stay open when an error message is shown?

This behavior is observed in Firefox 26.0 (on win7 x64) and NOT observed in Chrome or IE.

  • The dialog disappears if you click the email or password inputs as well. Again, only in FF (same setup as you)
    – Trojan
    Commented Jan 15, 2014 at 22:00

So this might predate the rest of the login changes, as I can reproduce it on the main site as well; I haven't tried recovering my account in a while though, so I can't say for sure. The email that the account recovery service sends is missing rather a lot of credentials...

only SE and myOpenID

There are a couple of problems here:

  1. It's missing two of the four credentials that show up on my profile's "my logins" popup:

    SE, Google, MyOpenID, Other

    My Google login and my own site's OpenID are missing completely.

  2. It doesn't tell me anything about the one OpenID credential (myOpenID) that it does list. Specifically, it doesn't tell me what the OpenID URL is (or even what my myOpenID username is) and it doesn't mention that this is an OpenID credential.

Now, in practice this may not matter, since the Stack Exchange account is listed and presumably would always work. But if that wasn't there, this would be a really useless email... So for testing purposes, I removed this credential from my account and generated the recovery email again using my Google email:

up to three of four

Lo and behold, a third option suddenly appears. Not the option that actually corresponds to the email I entered, but a third option none the less. Of course, in this scenario I very likely would care to know that I could log in using Google, since that's what I've done in the past - but there's no mention of this. Also, there's still no mention of what to do with the (now two) unidentified OpenID credentials.

I also did a third test using the email in my profile (which doesn't correspond to any of my credentials) - it appeared the same as the second test above, which would be particularly frustrating if I didn't already know I had a Google login associated with the account and wasn't able to guess at it.

The fourth test - re-adding the SE OpenID and triggering another email - didn't change anything either.

I should note that all of these emails do have a handy link that offers to quickly log me in and create an associated SE OpenID without any further issues. That probably mitigates a lot of the potential problems here, since even folks who can't remember (or determine from the email) which service they used to create the account can still regain access by creating a SE OpenID. It would be rather annoying for folks who don't like having a separate login on every site they use though.



Internet Explorer 10 Any major browser and a Stack Exchange OpenID.

Test case

  1. Go to https://meta.stackoverflow.com/users/login.
  2. Give the new login system your SE OpenID credentials.
  3. Click Log In.

Expected behaviour

You are now logged in.

Observed behaviour

Absolutely nothing happens.


Find your profile on https://openid.stackexchange.com, press Use your own URL to log in, extract the ID url (it's the href of the second <link> tag), then paste that into the "Use your own URL" box on the login page. You are now logged in.

  • Also happens with IE11.
    – 3ventic
    Commented Jan 26, 2014 at 11:26
  • I think they assume nobody is using IE anymore, which is almost correct. Commented Jan 26, 2014 at 12:44
  • 1
    Also happens on Chrome, both Android and Windows. Commented Jan 26, 2014 at 21:53
  • Oh dear, it happens on stock latest Firefox too. Commented Jan 27, 2014 at 3:21
  • 1
    Fixed now - meta.stackexchange.com/a/217575/140505
    – Oded
    Commented Jan 27, 2014 at 9:57

After finding the log out button again, I took this screenshot. Those two asterisks are for the username and password to log in with Stack Exchange. I suspect that I'm seeing this due to the firewall I'm behind at work, as it messes with the Google AJAX servers when using Firefox (Stack Exchange is all but unusable with Firefox at work).

Login bug

  • Clicking on Log in using Stack Exchange does nothing? The functionality does depend on jQuery (served from api.google.com).
    – Oded
    Commented Jan 15, 2014 at 13:38
  • Sorry, should have clarified a bit. I can still log in properly, but the formatting is a bit messed up. It's still functional, but not pretty, although I suspect it wouldn't work on Firefox while I'm in the office.
    – MBraedley
    Commented Jan 15, 2014 at 13:46
  • Oh hey, I can log in fine with Firefox. Mind you, the user experience is still broken without the JavaScript goodness from Google, so I'll of course stick with Chrome for my SE needs while at work.
    – MBraedley
    Commented Jan 15, 2014 at 13:52
  • 1
    You sure those asterisks are not LastPass's?
    – Braiam
    Commented Jan 15, 2014 at 18:07
  • @Braiam You seem to be right. They don't show up in incognito mode (which has LastPass disabled). So probably not an issue with my work firewall, but rather an issue with LastPass detecting username/password boxes that are currently hidden.
    – MBraedley
    Commented Jan 15, 2014 at 18:30
  • I feel stupid to ask, but: where's that log out option...?
    – Arjan
    Commented Jan 15, 2014 at 21:11
  • 1
    @Arjan meta.stackexchange.com/questions/210002/…
    – MBraedley
    Commented Jan 15, 2014 at 21:13
  • (Wow, I've been in that dropdown many times before giving in and asking...!)
    – Arjan
    Commented Jan 15, 2014 at 21:37

Right now, I‘m on a pretty old computer with an Iceweasel 3.5 (should be fully equivalent to Firefox 3.5). I could log in on SO correctly, but the login wasn‘t carried over to Meta. So on Meta, I had to log in again. But when I clicked the “Log in using Google” button, nothing happened.

I had to open the additional login options and enter the Google OpenID URL manually for it to work. I assume that the button didn‘t register the event handler well enough for this old browser?


If i am not logged-in and i want to up-vote an answer (for example), i am redirected to login page for the log-in process, BUT after the logging-in process:

Expected result: After the login process i expect that i would be redirected to my original page so i could continue from the same place.

Actual Result: I am being redirected to the main question page, i have to do a couple of "back"s in browser and refresh to find the page i was in and continue my work.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .