confirmation that a user is who they claim to be, either by verifying what they know (password), what they have (a key) or what they are (fingerprints).

learn more… | top users | synonyms

3
votes
1answer
252 views

How to manage credentials information to the user?

I've created a plugin for an editor. This plugin gets some information from the project and shows you all the related issues, getting the information from an external application (Github, gitlab, ...
1
vote
1answer
25 views

Is using screen unlock pattern feature a good option for login on mobile web

trying to come up with way(s) to reduce the users' drop off rate on mobile login/registration on a mobile web ecommerce site. 1 method i think could work and would like to probably test would be a ...
0
votes
0answers
11 views

Is there a way to verify a user beyond the generic FB Login, token and Touch ID?

I am part of a team that is in the process of creating an app which deals with monetary transfers. Our biggest concern is a receiver of the money being a con/fraud; I was wandering if there was a ...
1
vote
1answer
43 views

is replying to an sms a reliable way of authenticating a response

I have a web app which will relay messages from my desktop applications (which is a workflow application for my client). A typical message would be - 'you have booked your pc in for a service and we ...
3
votes
4answers
62 views

Challenging User Migration Problem

Our team has a challenging UX issue we are trying to solve neatly. We have rebuilt an existing system from scratch and there is a technical constraint that old users will need to re-register to the ...
3
votes
1answer
62 views

Mobile application without direct authorization \ registration

UX \ UI professionals. The question connects both the user experience and data security. We are going to build the app, where the user is going to pay for the services. He should enter his email, ...
6
votes
7answers
378 views

What is the best mobile number authorization strategy?

In recent years, mobile number has become an important factor for authentication and hence more and more enterprises employ methods to capture their users' mobile numbers using SMS. In a typical ...
1
vote
0answers
30 views

Are wearable device able to do heavy calculation [closed]

It is clear that some smartphone such as iPhone are able to do some biometric data calculations in order to identify users. Wearable devices if we consider it as an extension of smartphone, are they ...
3
votes
1answer
44 views

Should web sites have their own authentication?

If I am designing a web site that interacts with the same user over time via email or other messaging mediums, should I allow account creation on the web site using a traditional username/password/...
4
votes
1answer
75 views

How to explain the concept of choosing password to user

We have an online store application that uses one-time passwords for user login. The user enters her email address, and we email her a one-time password to log in with. She doesn't choose any ...
9
votes
5answers
6k views

Should my app send a confirmation email on user registration?

I'm grappling with the user registration experience for my application. I'm considering this model: User enters... Username Password Password confirmation Email address The app displays a ...
31
votes
8answers
24k views

How to tell the user his login credentials are incorrect?

When a user has entered incorrect details into a login form, is it better to tell them: The username or password you have entered is invalid. or The user name you have entered is invalid (for ...
1
vote
2answers
43 views

Linking multiple third-party accounts for a mobile app?

My user wants to access personal content from her Spotify, Soundcloud and other third-party accounts through one native mobile application. Imagine a music player for any personal library. The ...
4
votes
3answers
121 views

Correct UX for the scenario when a user forgets the answers to their security questions?

We have an application where a user is required upon registration to set up three security questions and answers When they login to the application, they must answer one of the questions after ...
8
votes
2answers
195 views

Dealing with Connected Social Accounts and Potential Orphans

Our application has the following signup paths: Twitter Connect Facebook Connect Email/Password Once you signup with one, you have the option to connect either both social account (in the case of an ...
16
votes
5answers
5k views

Is a “Login Successful” Message Necessary?

On an informational/forum website (say, similar to a StackExchange site), is it necessary to show a "login successful" message? Clarification: On the site in question, the users can log in by ...
2
votes
1answer
117 views

If a user has created an account on my iOS app using Google, how should I handle their effort to also create an email account?

Imagine a user logged into my iOS app using their Google account. Months later, they are trying to create an account using their email address (the same one connected to their previous Google social ...
4
votes
3answers
2k views

Facebook/Twitter login only vs. Facebook/Twitter signup and login separately

I have searched for this topic here, but haven't found solid answers for the problem. So the situation is this: we are creating the authentication screens for a mobile app and we are not sure which ...
3
votes
2answers
65 views

Authentication frequency for polling system

I am building a system to be used for polling during an election. Security is a massive issue as I'm sure you understand! We are using two factor authentication so the user will be asked to supply a ...
5
votes
4answers
284 views

Logging in with email only

I'm working on a blog and there will be an option to post a comment. I could implement registration with username, password and email — the standard way. I could implement 3rd-party authorization ...
1
vote
3answers
109 views

When entering data, should the user be authenticated on clicking “Create” or “Save”?

Having the two options: Check if user authenticated upon "Save" button click (when the input dialog is shown and filled in with the data) Check if user authenticated upon "Create" button click (...
9
votes
3answers
2k views

social sign in redirect vs popup window

I have seen that most websites usually open the "login with Facebook" page in a popup window, but there are also some websites (like stackexchange) that just redirect the browser without opening a ...
0
votes
3answers
536 views

Sign Up and Sign In widget on every page: Slide-down Panel or Lightbox

I have a question about implementing a sign up and sign in widget that works on any page on a site (i.e. without redirecting users to a sign in page when they want to log in to interact with content ...
0
votes
2answers
84 views

Back to login page authentication expiration behaviour

If a user presses back after logging in to a website should the authentication cookie be set to expire because the user expects to be logged out if they can see the login page or not?
1
vote
5answers
272 views

How can I make a login form seem more trustworthy?

We have a web app where the user has to log in at the beginning. The login shows our company logo, the name of the product incl. logo of the product and the login form: I showed this app to a test ...
1
vote
3answers
116 views

E-mail requirement in game signup process?

I have to make a signup form for a mobile web based game. I want to make is simple. I'm going to request an username and password from the player. May I request an e-mail, and send an activation mail ...
0
votes
2answers
55 views

Putting authentication in preferences

If authentication is completely optional, and provides next to no features, is it okay to dump it in a preferences tab?
2
votes
3answers
66 views

Visual indication of special privileges

I'm working on a mobile app for android and iOS that lets you manage sports teams. You can follow any team, but can only manage those your account is associated with (You're the coach, for example) ...
1
vote
2answers
190 views

Which social login should I use, Google OAuth2 or Google+?

Google supports 4 ways to "sign in with google" OAuth OAuth2 Google+ Google Apps I want a generic "sign in with google", I'm not doing anything app-specific, so the last one is out. Presumably ...
67
votes
11answers
14k views

Should users be allowed to use any special character they want when creating a password?

I came across a number of login configuration settings where there is a list of allowable special characters and was wondering: Does this limitation cater for a specific security or usability need? ...
6
votes
4answers
389 views

How many atempts should you give a user before invalidating his password?

What I am trying to avoid here is brute force attacks on a user's password. And I am thinking about doing that by invalidating his password when too many attempts are made in the same minute, hour, ...
3
votes
2answers
269 views

Should I verify e-mail format in login form?

My B2B web app's login form has an email and password field. So far, I'm only checking if the fields are empty. I then make my authentication request, if there's a problem I return only one kind of ...
1
vote
1answer
171 views

How to encourage users to download an app to complete strong authentication (two factor)

I'm designing a strong authentication (two factor) solution for a website. Users will be forced to use two factor (legal requirement). We have two supported methods an SMS verification code texted to ...
2
votes
1answer
57 views

In Single Sign On what does SAML “enabled” control do or mean?

I am currently working on the redesign of SSO signup process/form and want to understand what enabling SAML control implies. The rationale being that if an organisation does not have SSO enabled the ...
2
votes
1answer
83 views

A better alternative to asking secret questions and answers when logging in to a banking site

It seems to be a common practice of credit card and banking web sites to ask answers to secret questions each time you log in from a new computer (for obvious reasons) There are many frustrating ...
20
votes
10answers
4k views

How to ensure users can't sign up for multiple accounts?

I'm working on a web app right now which users will normally have to pay to use, but I want to also offer a short demo period (haven't settled on how long yet, but somewhere between 1 day and 1 week). ...
1
vote
2answers
233 views

What is the correct tab-indexing for a log-in form with a “forgot password” link?

I have a login form shown below, and I am trying to figure out the correct tabbing for it for the best accessibility and user-experience. This seems like a very common design, but I haven't found a ...
1
vote
2answers
254 views

Which Remember-Me option is the best?

Basically, there seem to be three different behaviours of "Remember Me" authentication: Definite: After a successful login, a user doesn't have to provide their credentials during a time span with a ...
5
votes
10answers
1k views

Is there any advantage of signup before login with social plugins?

I am building a site and was thinking about if there should be a signup option at all. I found the question about the difference between sign up and log in with Facebook/Google/etc but there was ...
0
votes
3answers
2k views

Better Registration for Mobile Apps

We want to let users register on our Mobile App with their Phone Number, then verify it using SMS without the need to enter a password -- may be like what WhatsApp is doing with their on-boarding ...
0
votes
1answer
123 views

Why do you need a login/ register button?

I'm wondering if it makes sense to have "login/register" buttons displayed on the website header. The client would be redirected anyway to the register/login page whenever it tries to access a ...
8
votes
4answers
5k views

How do I best tell a user that his/her account will be locked if they enter the wrong credentials too many times?

We are going to add an additional layer of security to our product by locking user accounts for a short period of time (configurable in the product, but probably 5-10 minutes) when a user has tried to ...
4
votes
1answer
293 views

What is the proper way to provide social media authentication: in login or register form?

We provided standard login/registration forms for providing email and password, but I'd also like to allow user use my website after oAuth authentication. Should they be able to register or login via ...
2
votes
5answers
862 views

Do people expect to mistype their passwords?

I expect people have to type in passwords pretty regularly. Sometimes if you haven't typed it in for a while but end up faced with a login prompt, you think you remember the password, type it in, and ...
4
votes
2answers
236 views

What is the best way to notify a user he doesn't have an account

As a helpdesk engineer I'm offering support on a rather big Belgian E-commerce website. While we have a vast number of users there are also many users whose account is deleted automatically after 1 ...
1
vote
2answers
157 views

UX Design where password is optional

I have a web site where some users authenticate with email/password and other users only require an email address to authenticate. I'm trying to make the most natural login screen, but I'm struggling ...
4
votes
2answers
182 views

How to ask for a user's identity?

My company is working on an internal phone application to be used by many users that requires authentication. Based on historical data, we can assume the likelihood of a user's identity at a given ...
1
vote
3answers
230 views

Is email field assistance still necessary?

For registration forms, it seems the trend now is to allow any password a user wants, as long as you inform him if it's weak. With this in mind, should we still validate email fields on the client ...
3
votes
2answers
89 views

Status feedback problem

We have a mobile application. To register in our application you need to enter your phone number. After that, you receive an SMS with a code you need to enter to confirm your phone number. There is a ...
2
votes
3answers
210 views

Forcing users to use a new password everytime they reset

This is getting common that while resetting one's password, web-applications force users not to use a password which they had used before. Just like forcing users to follow a particular pattern of ...