10

What is the best practice around messaging when a banned user attempts to log in? Specifically looking for messaging for (a) when the banned user tries to log in, and (b) when the banned user tries to reset their password.

Seems there are three options, going from more specific down to more generic:

  1. Message is shown stating the user is banned and can not be logged in
  2. Message is shown stating the user can not be logged in, and not state why
  3. No message shown.

UX side of the question is here: https://ux.stackexchange.com/questions/86634/banned-user-tries-to-log-in-show-a-banned-message-or-a-generic-cant-log-you

|improve this question
  • 1
    Out of curiosity, why do you want to block banned users from resetting passwords? Is it an implementation problem (to do that you'd need to use login code and you've blocked them from logging in), or is there a design reason? Knowing the "why" might help us help you with messaging. (Or might not, but it struck me as unusual so I'm asking.) – Monica Cellio Nov 5 '15 at 14:00
  • Good question, and I am still working that out. What we know is that there can be a banned user, and there exists some login functionality and reset password functionality. The need is to "handle" cases where a banned user attempts to use any of those functionalities. I guess that is the broader question. – GWR Nov 5 '15 at 14:11
10

Aside: Having "worked" in online communities in the past as a volunteer moderator, please take my answer with the pinch of salt it likely deserves.

1 - When the user attempts to login

Be honest!

Tell the user that they've been blocked from contributing to the community and give them the reason why (all this is subject to the platform you're using supporting this, of course!). Also, give them an avenue to respond / make contact. If it's a temporary ban and you want the user to re-join the community once they've cooled off, providing a way to "vent"/"feel that their voice has been heard" may well help.

2 - When the user attempts to reset their password

None of us are perfect. We all (or some of us!) know that we shouldn't use the same password across multiple sites. But we all (for a given definition of all!) do. Sites like Have I been pwned? allow people to find out when their credentials have been compromised and there should be no impediment to them then changing their password on any and all sites/services they use so that their accounts/online personas remain secure. There's nothing to gain in preventing a blocked user from changing their password (or email address), and everything to lose for the end user concerned.

|improve this answer
  • 2
    Excellent point on still allowing banned users to change their passwords. I hadn't considered that. – GWR Nov 6 '15 at 11:42
2

Absolutely you should tell them they are blocked. There should be a standard note that links to a page of reasons people get blocked, probably just an anchor in the standard list of community rules. The form letter lets the person know this is not a personal vendetta but an application of the rule of law; hopefully this will make them less embarrassed and less likely to try to lash out or wheedle in response. If they just can't login they don't get an error signal so they are unlikely to learn to improve their online behaviour.

|improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.