Over fourteen days, mobile registration succeeded 21 times and failed 72. Grouping the failures: 53 were the password policy, and eight more were people hitting an anti-abuse limit after retrying so often.

The rule is eight characters with a digit, a lowercase letter, an uppercase letter and a symbol. The mobile form required a password and said nothing else. All five rules were discoverable only by being refused.

Say the rule while it is being typed

The rules now appear as you type, in your language, word for word as the server states them — we harvested the wording from the server rather than writing our own, so the hint and the refusal cannot disagree. The policy is read from settings rather than hardcoded, so changing it changes the form without a release.

Something else was making the refusals harder to read. The app only sent a language header when a user had explicitly picked a language, and most had not — so of about sixty rejections carrying a server message, fifty-nine were in English, inside an otherwise Turkish form.

A name you cannot use

Usernames are restricted to ASCII. A person whose name is written in Arabic, Japanese or Turkish therefore cannot use it, has to invent a handle, and has to remember it at sign-in. One did not: they typed their display name into the login box three times on the same day. The form now suggests a usable handle from the e-mail address, and stops the moment you type your own.

And the link that went nowhere

Underneath all of it, since the 11th of August, the confirmation e-mail link had been answering "not found" for everyone who clicked it — and since confirmation is required to sign in, those accounts could not be used at all. It was looking for the account in the wrong place. It is fixed on the server too, so links already sitting in inboxes work, and the 26 stranded accounts were sent a fresh one.