Take the 2-minute tour ×
User Experience Stack Exchange is a question and answer site for user experience researchers and experts. It's 100% free, no registration required.

In my sign in page I made it so that the page doesn't need to reload when the wrong password is typed (similar to Google's). What should happen when the wrong password is typed? Right now I have text beneath the password field that says "wrong password or username" in red. I personally don't like red too often because I don't want the user to feel like something bad happened. Also should I clear the password field after they typed it in wrong? The only reason I can see this being bad is if the user wasn't sure of the last character (e.g. forget there's a 1 at the end of the password).

EDIT:One thing I didn't see in other questiosn is when should the message that the username/password is incorrect go away? For example, assuming the password field is automatically cleared after a wrong password, should the "wrong password" message disapear after the first character is entered in the password field?

share|improve this question

marked as duplicate by rk., JohnGB, Matt Obee, JonW Apr 25 '13 at 10:44

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

    
For colors: ux.stackexchange.com/questions/16317/… –  rk. Apr 24 '13 at 22:27
2  
@Celeritas, your original post asked two separate questions. As rk. pointed out, the first was asked elsewhere, so I've modified your post to contain only the second question. In general, it's best to ask only one question per post (because otherwise it would become confusing how to vote if someone had answered one question right but another question wrong). –  3nafish Apr 24 '13 at 23:20
1  
As of now, I don't find this question to be a duplicate of any of the linked questions above. Related, yes - but exact duplicate? No –  Benny Skogberg Apr 25 '13 at 3:58

2 Answers 2

Looking at this question from another angle may be helpful. A saved failed password isn't very useful. At least if you trust the most up voted answer to my question: Why do users erase all the password when they hit one wrong key instead of just the last wrong character?

The first one you mention yourself, it's an automated process. It's easier to perform an automated process from the beginning to the end rather than breaking in somewhere in the middle and trying to complete it. In other words, it may take a user less time to write the entire password than the last third of it, because that's not a muscle pattern in the same way as the entire password is.

The other reason I would say is in the masking of the password. When the user realizes that she probably slipped on the keyboard and stops writing, she stops in the automated process. It's hard to backtrack in an automated process where it went wrong. Did she stop right after the typo, or did she write a character after the typo? Looking at the masked text will not say much.

Issues like these simply makes it easier to rewrite the entire password rather than trying to mend a broken one.

Users aren't really helped with the saved password, so I think clearing it would be great for both security and user experience reasons.

share|improve this answer

You should clear both password and username, or neither, your choice.
Clearing one but not the other can get a hacker/cracker ideas about where he went wrong (he may well be guessing the username as well).
For the same reason you should never state which of the two is invalid when authentication fails. Instead of "invalid password" or "unknown user" give as an error "authentication failed, invalid username/password" or something like that..

share|improve this answer
1  
I disagree, you should always clear password but not username. As @BennySkogberg pointed out, the reason is that the user can read and fix faulty username, but they cannot (easily) fix faulty password because it's masked. Either way, doing this will not give an attacker any information that he didn't already know (that he inputted a certain username, which may or may not exist in the system). –  Lie Ryan Apr 25 '13 at 7:47
    
wrong, if he's guessing usernames as well, you just gave him valuable information, namely that that user exists. –  jwenting Apr 25 '13 at 8:19
    
how so? If a user with such username exists, it's shown again and if no user with such username exists, it's also shown again. What can the hacker infer from that? –  Lie Ryan Apr 25 '13 at 8:22

Not the answer you're looking for? Browse other questions tagged or ask your own question.