confirmation that a user is who they claim to be, either by verifying what they know (password), what they have (a key) or what they are (fingerprints).

learn more… | top users | synonyms

1
vote
1answer
52 views

Dealing with Connected Social Accounts and Potential Orphans

Our application has the following signup paths: Twitter Connect Facebook Connect Email/Password Once you signup with one, you have the option to connect either both social account (in the case of an ...
0
votes
1answer
255 views

Sign Up and Sign In widget on every page: Slide-down Panel or Lightbox

I have a question about implementing a sign up and sign in widget that works on any page on a site (i.e. without redirecting users to a sign in page when they want to log in to interact with content ...
1
vote
2answers
117 views

Which Remember-Me option is the best?

Basically, there seem to be three different behaviours of "Remember Me" authentication: Definite: After a successful login, a user doesn't have to provide their credentials during a time span with a ...
4
votes
10answers
366 views

Is there any advantage of signup before login with social plugins?

I am building a site and was thinking about if there should be a signup option at all. I found the question about the difference between sign up and log in with Facebook/Google/etc but there was ...
0
votes
3answers
164 views

Better Registration for Mobile Apps

We want to let users register on our Mobile App with their Phone Number, then verify it using SMS without the need to enter a password -- may be like what WhatsApp is doing with their on-boarding ...
0
votes
1answer
60 views

Why do you need a login/ register button?

I'm wondering if it makes sense to have "login/register" buttons displayed on the website header. The client would be redirected anyway to the register/login page whenever it tries to access a ...
23
votes
8answers
6k views

How to tell the user his login credentials are incorrect?

When a user has entered incorrect details into a login form, is it better to tell them: The username or password you have entered is invalid. or The user name you have entered is invalid (for ...
5
votes
4answers
1k views

How do I best tell a user that his/her account will be locked if they enter the wrong credentials too many times?

We are going to add an additional layer of security to our product by locking user accounts for a short period of time (configurable in the product, but probably 5-10 minutes) when a user has tried to ...
4
votes
1answer
118 views

What is the proper way to provide social media authentication: in login or register form?

We provided standard login/registration forms for providing email and password, but I'd also like to allow user use my website after oAuth authentication. Should they be able to register or login via ...
6
votes
3answers
476 views

social sign in redirect vs popup window

I have seen that most websites usually open the "login with Facebook" page in a popup window, but there are also some websites (like stackexchange) that just redirect the browser without opening a ...
2
votes
5answers
594 views

Do people expect to mistype their passwords?

I expect people have to type in passwords pretty regularly. Sometimes if you haven't typed it in for a while but end up faced with a login prompt, you think you remember the password, type it in, and ...
3
votes
2answers
138 views

What is the best way to notify a user he doesn't have an account

As a helpdesk engineer I'm offering support on a rather big Belgian E-commerce website. While we have a vast number of users there are also many users whose account is deleted automatically after 1 ...
1
vote
2answers
117 views

UX Design where password is optional

I have a web site where some users authenticate with email/password and other users only require an email address to authenticate. I'm trying to make the most natural login screen, but I'm struggling ...
4
votes
2answers
165 views

How to ask for a user's identity?

My company is working on an internal phone application to be used by many users that requires authentication. Based on historical data, we can assume the likelihood of a user's identity at a given ...
0
votes
3answers
192 views

Is email field assistance still necessary?

For registration forms, it seems the trend now is to allow any password a user wants, as long as you inform him if it's weak. With this in mind, should we still validate email fields on the client ...
3
votes
2answers
71 views

Status feedback problem

We have a mobile application. To register in our application you need to enter your phone number. After that, you receive an SMS with a code you need to enter to confirm your phone number. There is a ...
2
votes
3answers
132 views

Forcing users to use a new password everytime they reset

This is getting common that while resetting one's password, web-applications force users not to use a password which they had used before. Just like forcing users to follow a particular pattern of ...
7
votes
2answers
117 views

Masked password characters in a GUI vs terminal

In a GUI form, or for example a login box on a website, it's usual for masked characters to appear like ********* as you type out your password. But in terminal applications, for example ssh, this ...
4
votes
3answers
369 views

Is offering more than one openid/social-sign-in option a good idea?

Lots of sites nowadays offer the option to log in via Google, Facebook, LinkedIn and so on, and sometimes a standard username/password option as well. While this goes a long way toward helping users ...
0
votes
0answers
60 views

Are users more likely to sign up with social login? [duplicate]

These days social login (via Facebook, Google, Yahoo, etc.) is becoming more and more popular. But it has problems: some users are reluctant to link their accounts on different sites to each other, ...
5
votes
3answers
194 views

Logging in with email only

I'm working on a blog and there will be an option to post a comment. I could implement registration with username, password and email — the standard way. I could implement 3rd-party authorization ...
13
votes
6answers
688 views

What is the best way to request individual characters from a password?

Frequently, sites that should really value security (especially banks) ask for several individual characters from a password. Typically I've seen them do it like this: download bmml source ...
25
votes
6answers
1k views

Forcing users to use a particular pattern for passwords

Many websites, specially government ones, enforce users to use a password which conforms to particular criteria. For example: use between 8-13 characters with at-least one integer and one capital ...
21
votes
2answers
607 views

What's better for invitation emails: a temporary password or a one-time login url?

Our web app allows our customers to invite their collaborators into their account. They can submit the new user's email address, and our app sends the new user an email inviting them to login. Once ...
2
votes
1answer
182 views

Best way to add account providers?

I briefly looked at spotify and I found that they use 2 providers: Themselves and facebook. Ie I can log in to spotify with facebook. But then it asks me for my spotify account when I downloaded the ...
3
votes
1answer
191 views

Looking for 'planner' design patterns and opinions

We are designing a revamped part-time studies course catalogue at the post-secondary institution where I work. One of the features I have included is an authenticated planner for saving and ...
20
votes
5answers
1k views

Whats more user friendly local authentication or remote authentication (OpenID, OAuth)

from a usability perspective only (not security) what do users find more comfortable A site with it's own login page (need to sign up but then easier to login) or a site with remote authentication ...
3
votes
1answer
74 views

Mass user authentication for a bracket system

I'm currently setting up a layout for a website that's going to be a sort of "bracket" website, where users can sign up and they can be approved/denied by an administrator. I'm currently at a ...
0
votes
1answer
136 views

How should I go about integrating Mozilla Persona in a website?

For those who've never heard of it before, Mozilla Persona is a single sign-on method that's pretty strict on privacy. For me, as a website administrator, it means that I don't need to ask the user ...
15
votes
5answers
1k views

Should I use two steps or one when users change password?

I currently have a page dedicated to changing passwords. There are 2 options: A 2 step option: download bmml source – Wireframes created with Balsamiq Mockups download bmml ...
3
votes
4answers
630 views

Password validation in login form

In registration form, I have client side validation for strength of password. For example password should be not less than 6 symbols, consists at least 1 digit, and at least 1 letter. For example: ...
7
votes
3answers
2k views

Should my app send a confirmation email on user registration?

I'm grappling with the user registration experience for my application. I'm considering this model: User enters... Username Password Password confirmation Email address The app displays a ...
2
votes
1answer
130 views

User Authentication/Timeout for web-app with personal Information

The concept behind "Remember my Username" and even allowing browsers to save your "username and password" for this site seems like it could be controversial. Given that different audiences prefer ...
11
votes
3answers
636 views

Is it bad practice not to allow users to create an account (versus OAuth or OpenID)?

When creating a website is it poor practice not to give users the option to "create an account"? Especially with rapid development, it seems more secure with less effort to offload authentication. ...
4
votes
2answers
170 views

How to request a third-party login within a seperate mobile application

I'm designing a mobile app that requires the user to log-in with their LinkedIn account. I feel I might have cluttered too much info into it, but everything seems to be important. I want the user ...
5
votes
4answers
316 views

Biometrics Activated UI

I'm having a problem regarding a user interface with bio-metrics inter action in employee logging in/out. The employee needs to choose whether he/she will login or logout and enter his/her employee ...
6
votes
1answer
120 views

What OpenID log-in screen is appropriate for people who don't understand SAML, OpenID, or Federation?

Every person that I've introduced to Stackexchange has had the same question/problem... that is they are confused by options to log using "gmail" or "hotmail" and assume that this is an email ...
5
votes
1answer
152 views

How important is social sign-up to attracting new users?

Many website, including this one, are using social sign-up to speed up new user registrations. I'd like to know what are the adoption rates of this service, and whether there are any pitfalls to using ...
2
votes
2answers
215 views

When is user authentication really necessary?

Better said, how much harder is to mantain a forum/message-board/community webiste with unauthenticated users and what would be the benefits and disadvantages in comparison to an account-based one? ...
1
vote
2answers
185 views

Authentication pop up on a desktop app: what if it is much bigger than main app window?

I am working on a desktop app that requires authentication. It allows federated authentication using different services, Google among them. Most probably, we'll use a pop up with a browser window to ...
0
votes
1answer
145 views

When should “Log on” or “Log off” be used? [duplicate]

Possible Duplicate: Using “Sign in” vs using “Log in” I'm porting an old application that has a "Log on" screen. When would I use "Log on" vs the alternatives (Sign ...
6
votes
2answers
306 views

How can I encourage users to authenticate?

I am working on a post-sale customer support project for a US high street retailer (for the rest of this post I will refer to them as 'Jon's Cellphones'). The program will enable customers who ...
2
votes
6answers
798 views

WebApp User Login Screen

I am currently considering options for a web/intranet application login screen and this seems like a good place to share. Not much work has gone into the current screen since creation and it exists ...
9
votes
5answers
577 views

Why would you, for a local authentication site, have usernames, instead of using e-mail address to login?

In websites where authentication is local, or mixed local and remote (e.g. OpenID), I still often see the question for a username. I can very well understand this in the case of twitter, where the ...
4
votes
6answers
414 views

Is there a way to disallow multiple votes from one user without forcing authentication? [closed]

I'm looking for a way to prohibit voting rigging (cache/cookie-clearing, etc.) without requiring the user to jump through hoops (registration, authentication, etc.). Any ideas?
4
votes
4answers
245 views

Business application: Is it better to redirect or pop-up for re-authentication?

This question is geared for a line of business application someone would pay for, not a general public facing website. Is it better to redirect for authentication/re-authentication or show a pop-up? ...