confirmation that a user is who they claim to be, either by verifying what they know (password), what they have (a key) or what they are (fingerprints).

learn more… | top users | synonyms

1
vote
1answer
233 views

How to manage credentials information to the user?

I've created a plugin for an editor. This plugin gets some information from the project and shows you all the related issues, getting the information from an external application (Github, gitlab, ...
1
vote
1answer
47 views

Mobile application without direct authorization \ registration

UX \ UI professionals. The question connects both the user experience and data security. We are going to build the app, where the user is going to pay for the services. He should enter his email, ...
6
votes
7answers
342 views

What is the best mobile number authorization strategy?

In recent years, mobile number has become an important factor for authentication and hence more and more enterprises employ methods to capture their users' mobile numbers using SMS. In a typical ...
1
vote
0answers
28 views

Are wearable device able to do heavy calculation [closed]

It is clear that some smartphone such as iPhone are able to do some biometric data calculations in order to identify users. Wearable devices if we consider it as an extension of smartphone, are they ...
3
votes
1answer
43 views

Should web sites have their own authentication?

If I am designing a web site that interacts with the same user over time via email or other messaging mediums, should I allow account creation on the web site using a traditional ...
4
votes
1answer
70 views

How to explain the concept of choosing password to user

We have an online store application that uses one-time passwords for user login. The user enters her email address, and we email her a one-time password to log in with. She doesn't choose any ...
9
votes
5answers
6k views

Should my app send a confirmation email on user registration?

I'm grappling with the user registration experience for my application. I'm considering this model: User enters... Username Password Password confirmation Email address The app displays a ...
31
votes
8answers
22k views

How to tell the user his login credentials are incorrect?

When a user has entered incorrect details into a login form, is it better to tell them: The username or password you have entered is invalid. or The user name you have entered is invalid (for ...
1
vote
2answers
36 views

Linking multiple third-party accounts for a mobile app?

My user wants to access personal content from her Spotify, Soundcloud and other third-party accounts through one native mobile application. Imagine a music player for any personal library. The ...
4
votes
3answers
110 views

Correct UX for the scenario when a user forgets the answers to their security questions?

We have an application where a user is required upon registration to set up three security questions and answers When they login to the application, they must answer one of the questions after ...
8
votes
2answers
192 views

Dealing with Connected Social Accounts and Potential Orphans

Our application has the following signup paths: Twitter Connect Facebook Connect Email/Password Once you signup with one, you have the option to connect either both social account (in the case of an ...
15
votes
5answers
4k views

Is a “Login Successful” Message Necessary?

On an informational/forum website (say, similar to a StackExchange site), is it necessary to show a "login successful" message? Clarification: On the site in question, the users can log in by ...
2
votes
1answer
109 views

If a user has created an account on my iOS app using Google, how should I handle their effort to also create an email account?

Imagine a user logged into my iOS app using their Google account. Months later, they are trying to create an account using their email address (the same one connected to their previous Google social ...
3
votes
3answers
2k views

Facebook/Twitter login only vs. Facebook/Twitter signup and login separately

I have searched for this topic here, but haven't found solid answers for the problem. So the situation is this: we are creating the authentication screens for a mobile app and we are not sure which ...
3
votes
2answers
64 views

Authentication frequency for polling system

I am building a system to be used for polling during an election. Security is a massive issue as I'm sure you understand! We are using two factor authentication so the user will be asked to supply a ...
5
votes
4answers
284 views

Logging in with email only

I'm working on a blog and there will be an option to post a comment. I could implement registration with username, password and email — the standard way. I could implement 3rd-party authorization ...
1
vote
3answers
107 views

When entering data, should the user be authenticated on clicking “Create” or “Save”?

Having the two options: Check if user authenticated upon "Save" button click (when the input dialog is shown and filled in with the data) Check if user authenticated upon "Create" button click ...
9
votes
3answers
1k views

social sign in redirect vs popup window

I have seen that most websites usually open the "login with Facebook" page in a popup window, but there are also some websites (like stackexchange) that just redirect the browser without opening a ...
0
votes
3answers
533 views

Sign Up and Sign In widget on every page: Slide-down Panel or Lightbox

I have a question about implementing a sign up and sign in widget that works on any page on a site (i.e. without redirecting users to a sign in page when they want to log in to interact with content ...
0
votes
2answers
82 views

Back to login page authentication expiration behaviour

If a user presses back after logging in to a website should the authentication cookie be set to expire because the user expects to be logged out if they can see the login page or not?
1
vote
5answers
266 views

How can I make a login form seem more trustworthy?

We have a web app where the user has to log in at the beginning. The login shows our company logo, the name of the product incl. logo of the product and the login form: I showed this app to a test ...
1
vote
3answers
112 views

E-mail requirement in game signup process?

I have to make a signup form for a mobile web based game. I want to make is simple. I'm going to request an username and password from the player. May I request an e-mail, and send an activation mail ...
0
votes
2answers
55 views

Putting authentication in preferences

If authentication is completely optional, and provides next to no features, is it okay to dump it in a preferences tab?
2
votes
3answers
64 views

Visual indication of special privileges

I'm working on a mobile app for android and iOS that lets you manage sports teams. You can follow any team, but can only manage those your account is associated with (You're the coach, for example) ...
1
vote
2answers
179 views

Which social login should I use, Google OAuth2 or Google+?

Google supports 4 ways to "sign in with google" OAuth OAuth2 Google+ Google Apps I want a generic "sign in with google", I'm not doing anything app-specific, so the last one is out. Presumably ...
66
votes
11answers
13k views

Should users be allowed to use any special character they want when creating a password?

I came across a number of login configuration settings where there is a list of allowable special characters and was wondering: Does this limitation cater for a specific security or usability need? ...
6
votes
4answers
372 views

How many atempts should you give a user before invalidating his password?

What I am trying to avoid here is brute force attacks on a user's password. And I am thinking about doing that by invalidating his password when too many attempts are made in the same minute, hour, ...
3
votes
2answers
262 views

Should I verify e-mail format in login form?

My B2B web app's login form has an email and password field. So far, I'm only checking if the fields are empty. I then make my authentication request, if there's a problem I return only one kind of ...
1
vote
1answer
165 views

How to encourage users to download an app to complete strong authentication (two factor)

I'm designing a strong authentication (two factor) solution for a website. Users will be forced to use two factor (legal requirement). We have two supported methods an SMS verification code texted to ...
2
votes
1answer
57 views

In Single Sign On what does SAML “enabled” control do or mean?

I am currently working on the redesign of SSO signup process/form and want to understand what enabling SAML control implies. The rationale being that if an organisation does not have SSO enabled the ...
2
votes
1answer
81 views

A better alternative to asking secret questions and answers when logging in to a banking site

It seems to be a common practice of credit card and banking web sites to ask answers to secret questions each time you log in from a new computer (for obvious reasons) There are many frustrating ...
20
votes
10answers
4k views

How to ensure users can't sign up for multiple accounts?

I'm working on a web app right now which users will normally have to pay to use, but I want to also offer a short demo period (haven't settled on how long yet, but somewhere between 1 day and 1 week). ...
1
vote
2answers
210 views

What is the correct tab-indexing for a log-in form with a “forgot password” link?

I have a login form shown below, and I am trying to figure out the correct tabbing for it for the best accessibility and user-experience. This seems like a very common design, but I haven't found a ...
1
vote
2answers
238 views

Which Remember-Me option is the best?

Basically, there seem to be three different behaviours of "Remember Me" authentication: Definite: After a successful login, a user doesn't have to provide their credentials during a time span with a ...
5
votes
10answers
1k views

Is there any advantage of signup before login with social plugins?

I am building a site and was thinking about if there should be a signup option at all. I found the question about the difference between sign up and log in with Facebook/Google/etc but there was ...
0
votes
3answers
2k views

Better Registration for Mobile Apps

We want to let users register on our Mobile App with their Phone Number, then verify it using SMS without the need to enter a password -- may be like what WhatsApp is doing with their on-boarding ...
0
votes
1answer
113 views

Why do you need a login/ register button?

I'm wondering if it makes sense to have "login/register" buttons displayed on the website header. The client would be redirected anyway to the register/login page whenever it tries to access a ...
7
votes
4answers
4k views

How do I best tell a user that his/her account will be locked if they enter the wrong credentials too many times?

We are going to add an additional layer of security to our product by locking user accounts for a short period of time (configurable in the product, but probably 5-10 minutes) when a user has tried to ...
4
votes
1answer
281 views

What is the proper way to provide social media authentication: in login or register form?

We provided standard login/registration forms for providing email and password, but I'd also like to allow user use my website after oAuth authentication. Should they be able to register or login via ...
2
votes
5answers
843 views

Do people expect to mistype their passwords?

I expect people have to type in passwords pretty regularly. Sometimes if you haven't typed it in for a while but end up faced with a login prompt, you think you remember the password, type it in, and ...
3
votes
2answers
230 views

What is the best way to notify a user he doesn't have an account

As a helpdesk engineer I'm offering support on a rather big Belgian E-commerce website. While we have a vast number of users there are also many users whose account is deleted automatically after 1 ...
1
vote
2answers
151 views

UX Design where password is optional

I have a web site where some users authenticate with email/password and other users only require an email address to authenticate. I'm trying to make the most natural login screen, but I'm struggling ...
4
votes
2answers
181 views

How to ask for a user's identity?

My company is working on an internal phone application to be used by many users that requires authentication. Based on historical data, we can assume the likelihood of a user's identity at a given ...
1
vote
3answers
227 views

Is email field assistance still necessary?

For registration forms, it seems the trend now is to allow any password a user wants, as long as you inform him if it's weak. With this in mind, should we still validate email fields on the client ...
3
votes
2answers
89 views

Status feedback problem

We have a mobile application. To register in our application you need to enter your phone number. After that, you receive an SMS with a code you need to enter to confirm your phone number. There is a ...
2
votes
3answers
200 views

Forcing users to use a new password everytime they reset

This is getting common that while resetting one's password, web-applications force users not to use a password which they had used before. Just like forcing users to follow a particular pattern of ...
7
votes
2answers
165 views

Masked password characters in a GUI vs terminal

In a GUI form, or for example a login box on a website, it's usual for masked characters to appear like ********* as you type out your password. But in terminal applications, for example ssh, this ...
4
votes
3answers
467 views

Is offering more than one openid/social-sign-in option a good idea?

Lots of sites nowadays offer the option to log in via Google, Facebook, LinkedIn and so on, and sometimes a standard username/password option as well. While this goes a long way toward helping users ...
0
votes
0answers
69 views

Are users more likely to sign up with social login? [duplicate]

These days social login (via Facebook, Google, Yahoo, etc.) is becoming more and more popular. But it has problems: some users are reluctant to link their accounts on different sites to each other, ...
14
votes
6answers
747 views

What is the best way to request individual characters from a password?

Frequently, sites that should really value security (especially banks) ask for several individual characters from a password. Typically I've seen them do it like this: download bmml source ...