confirmation that a user is who they claim to be, either by verifying what they know (password), what they have (a key) or what they are (fingerprints).

learn more… | top users | synonyms

0
votes
1answer
21 views

If a user has created an account on my iOS app using Google, how should I handle their effort to also create an email account?

Imagine a user logged into my iOS app using their Google account. Months later, they are trying to create an account using their email address (the same one connected to their previous Google social ...
0
votes
3answers
99 views

When entering data, should the user be authenticated on clicking “Create” or “Save”?

Having the two options: Check if user authenticated upon "Save" button click (when the input dialog is shown and filled in with the data) Check if user authenticated upon "Create" button click ...
0
votes
2answers
54 views

Back to login page authentication expiration behaviour

If a user presses back after logging in to a website should the authentication cookie be set to expire because the user expects to be logged out if they can see the login page or not?
1
vote
5answers
213 views

How can I make a login form seem more trustworthy?

We have a web app where the user has to log in at the beginning. The login shows our company logo, the name of the product incl. logo of the product and the login form: I showed this app to a test ...
2
votes
3answers
53 views

Visual indication of special privileges

I'm working on a mobile app for android and iOS that lets you manage sports teams. You can follow any team, but can only manage those your account is associated with (You're the coach, for example) ...
1
vote
2answers
83 views

Which social login should I use, Google OAuth2 or Google+?

Google supports 4 ways to "sign in with google" OAuth OAuth2 Google+ Google Apps I want a generic "sign in with google", I'm not doing anything app-specific, so the last one is out. Presumably ...
6
votes
4answers
256 views

How many atempts should you give a user before invalidating his password?

What I am trying to avoid here is brute force attacks on a user's password. And I am thinking about doing that by invalidating his password when too many attempts are made in the same minute, hour, ...
3
votes
2answers
137 views

Should I verify e-mail format in login form?

My B2B web app's login form has an email and password field. So far, I'm only checking if the fields are empty. I then make my authentication request, if there's a problem I return only one kind of ...
1
vote
1answer
75 views

How to encourage users to download an app to complete strong authentication (two factor)

I'm designing a strong authentication (two factor) solution for a website. Users will be forced to use two factor (legal requirement). We have two supported methods an SMS verification code texted to ...
2
votes
1answer
43 views

In Single Sign On what does SAML “enabled” control do or mean?

I am currently working on the redesign of SSO signup process/form and want to understand what enabling SAML control implies. The rationale being that if an organisation does not have SSO enabled the ...
60
votes
11answers
9k views

Should users be allowed to use any special character they want when creating a password?

I came across a number of login configuration settings where there is a list of allowable special characters and was wondering: Does this limitation cater for a specific security or usability need? ...
1
vote
1answer
45 views

A better alternative to asking secret questions and answers when logging in to a banking site

It seems to be a common practice of credit card and banking web sites to ask answers to secret questions each time you log in from a new computer (for obvious reasons) There are many frustrating ...
17
votes
10answers
3k views

How to ensure users can't sign up for multiple accounts?

I'm working on a web app right now which users will normally have to pay to use, but I want to also offer a short demo period (haven't settled on how long yet, but somewhere between 1 day and 1 week). ...
0
votes
2answers
50 views

Putting authentication in preferences

If authentication is completely optional, and provides next to no features, is it okay to dump it in a preferences tab?
1
vote
2answers
106 views

What is the correct tab-indexing for a log-in form with a “forgot password” link?

I have a login form shown below, and I am trying to figure out the correct tabbing for it for the best accessibility and user-experience. This seems like a very common design, but I haven't found a ...
3
votes
2answers
214 views

Facebook/Twitter login only vs. Facebook/Twitter signup and login separately

I have searched for this topic here, but haven't found solid answers for the problem. So the situation is this: we are creating the authentication screens for a mobile app and we are not sure which ...
1
vote
2answers
173 views

Which Remember-Me option is the best?

Basically, there seem to be three different behaviours of "Remember Me" authentication: Definite: After a successful login, a user doesn't have to provide their credentials during a time span with a ...
0
votes
1answer
143 views

How to manage credentials information to the user?

I've created a plugin for an editor. This plugin gets some information from the project and shows you all the related issues, getting the information from an external application (Github, gitlab, ...
5
votes
10answers
571 views

Is there any advantage of signup before login with social plugins?

I am building a site and was thinking about if there should be a signup option at all. I found the question about the difference between sign up and log in with Facebook/Google/etc but there was ...
1
vote
3answers
98 views

E-mail requirement in game signup process?

I have to make a signup form for a mobile web based game. I want to make is simple. I'm going to request an username and password from the player. May I request an e-mail, and send an activation mail ...
0
votes
1answer
80 views

Why do you need a login/ register button?

I'm wondering if it makes sense to have "login/register" buttons displayed on the website header. The client would be redirected anyway to the register/login page whenever it tries to access a ...
0
votes
3answers
706 views

Better Registration for Mobile Apps

We want to let users register on our Mobile App with their Phone Number, then verify it using SMS without the need to enter a password -- may be like what WhatsApp is doing with their on-boarding ...
4
votes
1answer
122 views

Dealing with Connected Social Accounts and Potential Orphans

Our application has the following signup paths: Twitter Connect Facebook Connect Email/Password Once you signup with one, you have the option to connect either both social account (in the case of an ...
0
votes
3answers
492 views

Sign Up and Sign In widget on every page: Slide-down Panel or Lightbox

I have a question about implementing a sign up and sign in widget that works on any page on a site (i.e. without redirecting users to a sign in page when they want to log in to interact with content ...
4
votes
1answer
198 views

What is the proper way to provide social media authentication: in login or register form?

We provided standard login/registration forms for providing email and password, but I'd also like to allow user use my website after oAuth authentication. Should they be able to register or login via ...
2
votes
5answers
736 views

Do people expect to mistype their passwords?

I expect people have to type in passwords pretty regularly. Sometimes if you haven't typed it in for a while but end up faced with a login prompt, you think you remember the password, type it in, and ...
3
votes
2answers
170 views

What is the best way to notify a user he doesn't have an account

As a helpdesk engineer I'm offering support on a rather big Belgian E-commerce website. While we have a vast number of users there are also many users whose account is deleted automatically after 1 ...
6
votes
3answers
877 views

social sign in redirect vs popup window

I have seen that most websites usually open the "login with Facebook" page in a popup window, but there are also some websites (like stackexchange) that just redirect the browser without opening a ...
4
votes
2answers
175 views

How to ask for a user's identity?

My company is working on an internal phone application to be used by many users that requires authentication. Based on historical data, we can assume the likelihood of a user's identity at a given ...
1
vote
2answers
134 views

UX Design where password is optional

I have a web site where some users authenticate with email/password and other users only require an email address to authenticate. I'm trying to make the most natural login screen, but I'm struggling ...
0
votes
3answers
207 views

Is email field assistance still necessary?

For registration forms, it seems the trend now is to allow any password a user wants, as long as you inform him if it's weak. With this in mind, should we still validate email fields on the client ...
3
votes
2answers
82 views

Status feedback problem

We have a mobile application. To register in our application you need to enter your phone number. After that, you receive an SMS with a code you need to enter to confirm your phone number. There is a ...
2
votes
3answers
174 views

Forcing users to use a new password everytime they reset

This is getting common that while resetting one's password, web-applications force users not to use a password which they had used before. Just like forcing users to follow a particular pattern of ...
7
votes
2answers
122 views

Masked password characters in a GUI vs terminal

In a GUI form, or for example a login box on a website, it's usual for masked characters to appear like ********* as you type out your password. But in terminal applications, for example ssh, this ...
0
votes
0answers
64 views

Are users more likely to sign up with social login? [duplicate]

These days social login (via Facebook, Google, Yahoo, etc.) is becoming more and more popular. But it has problems: some users are reluctant to link their accounts on different sites to each other, ...
27
votes
6answers
2k views

Forcing users to use a particular pattern for passwords

Many websites, specially government ones, enforce users to use a password which conforms to particular criteria. For example: use between 8-13 characters with at-least one integer and one capital ...
13
votes
6answers
717 views

What is the best way to request individual characters from a password?

Frequently, sites that should really value security (especially banks) ask for several individual characters from a password. Typically I've seen them do it like this: download bmml source ...
21
votes
2answers
742 views

What's better for invitation emails: a temporary password or a one-time login url?

Our web app allows our customers to invite their collaborators into their account. They can submit the new user's email address, and our app sends the new user an email inviting them to login. Once ...
5
votes
3answers
222 views

Logging in with email only

I'm working on a blog and there will be an option to post a comment. I could implement registration with username, password and email — the standard way. I could implement 3rd-party authorization ...
0
votes
1answer
154 views

How should I go about integrating Mozilla Persona in a website?

For those who've never heard of it before, Mozilla Persona is a single sign-on method that's pretty strict on privacy. For me, as a website administrator, it means that I don't need to ask the user ...
3
votes
1answer
82 views

Mass user authentication for a bracket system

I'm currently setting up a layout for a website that's going to be a sort of "bracket" website, where users can sign up and they can be approved/denied by an administrator. I'm currently at a ...
8
votes
3answers
4k views

Should my app send a confirmation email on user registration?

I'm grappling with the user registration experience for my application. I'm considering this model: User enters... Username Password Password confirmation Email address The app displays a ...
15
votes
5answers
2k views

Should I use two steps or one when users change password?

I currently have a page dedicated to changing passwords. There are 2 options: A 2 step option: download bmml source – Wireframes created with Balsamiq Mockups download bmml ...
5
votes
4answers
2k views

How do I best tell a user that his/her account will be locked if they enter the wrong credentials too many times?

We are going to add an additional layer of security to our product by locking user accounts for a short period of time (configurable in the product, but probably 5-10 minutes) when a user has tried to ...
2
votes
1answer
144 views

User Authentication/Timeout for web-app with personal Information

The concept behind "Remember my Username" and even allowing browsers to save your "username and password" for this site seems like it could be controversial. Given that different audiences prefer ...
4
votes
2answers
179 views

How to request a third-party login within a seperate mobile application

I'm designing a mobile app that requires the user to log-in with their LinkedIn account. I feel I might have cluttered too much info into it, but everything seems to be important. I want the user ...
3
votes
4answers
857 views

Password validation in login form

In registration form, I have client side validation for strength of password. For example password should be not less than 6 symbols, consists at least 1 digit, and at least 1 letter. For example: ...
5
votes
4answers
404 views

Biometrics Activated UI

I'm having a problem regarding a user interface with bio-metrics inter action in employee logging in/out. The employee needs to choose whether he/she will login or logout and enter his/her employee ...
11
votes
3answers
1k views

Is it bad practice not to allow users to create an account (versus OAuth or OpenID)?

When creating a website is it poor practice not to give users the option to "create an account"? Especially with rapid development, it seems more secure with less effort to offload authentication. ...
6
votes
1answer
126 views

What OpenID log-in screen is appropriate for people who don't understand SAML, OpenID, or Federation?

Every person that I've introduced to Stackexchange has had the same question/problem... that is they are confused by options to log using "gmail" or "hotmail" and assume that this is an email ...