Take the 2-minute tour ×
User Experience Stack Exchange is a question and answer site for user experience researchers and experts. It's 100% free, no registration required.

Our application may contact different servers using background processes to update local data. Some servers require authentication, others don't. When accessing the first time a server, our application asks for the credentials and stores them in a master-password encrypted storage. When reopening the application, it needs to ask for the master-password to use the stored credentials (similar to Firefox). As you can imagine, this can happen when the user does not expect it (in contrast to Firefox), because of the background processes.

What options do we have - ask the user for the master-password at application start, simply skip to connect the servers where authentication is required until the user provided the master-password using an explicit action?

share|improve this question

2 Answers 2

I'd opt to a) check on startup to see if the required server credentials are still valid, or if a new session needs a fresh authentication, and if so, b) present the request for the master password at startup so that you can provide a nice smooth session that incorporates the background data.

The small tax of authenticating at the start of the session prevents interruption at a less optimal time, and can become a habit that, while a bit annoying, prevents bigger annoyance at less predictable times.

share|improve this answer

A few ideas:

  • If you're doing background updates, why not use a background message? Similar to Google Chrome's top message bar: Google Chrome's top message bar Something along the lines of "Log in to update".
  • Similarly, if you're updating a table or list, you could post a message in the first or last row, asking the user to log in to see the latest data.
  • Completely opposed to your question, but why do they need to log in again? Couldn't the client store the encrypted password and send that securely to the server and authenticate?
share|improve this answer
    
Your 1st point: it might be that there is no window displayed at all. Your last point: storing credentials without a master-password is possible, but less secure. –  Mike L. Aug 19 '11 at 15:32

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.