0
votes
2answers
164 views

Error message for “Invalid Username”

As per "UX guidelines" what should be the error message for a dimmpley Login for having 2 basic fields "Username" & Password. So if a User Enter a username with "Space or special ...
2
votes
4answers
764 views

How to show user login password is wrong after the first time e.g. flash “wrong password” message

This is a follow up to this question asking about what should be displayed when a user enters a wrong password. Here is my current design: when logging into a website if the user enters a wrong ...
6
votes
2answers
180 views

When should the message informing the user that the password they entered is wrong go away?

This is a follow up to this question since it got closed. In a log in form, after the user enters the wrong password, when should the message saying "wrong password or user name" go away? For example ...
2
votes
2answers
157 views

What to present when wrong log in information entered [duplicate]

In my sign in page I made it so that the page doesn't need to reload when the wrong password is typed (similar to Google's). What should happen when the wrong password is typed? Right now I have text ...
4
votes
4answers
275 views

What's the point in asking the user to do what an application can do itself?

I recently logged in my Microsoft account with my 25 characters password and saw this: The only reasonable reaction I could have was: "WTF! Are they out of their mind to ask me to shorten the ...
5
votes
4answers
1k views

How do I best tell a user that his/her account will be locked if they enter the wrong credentials too many times?

We are going to add an additional layer of security to our product by locking user accounts for a short period of time (configurable in the product, but probably 5-10 minutes) when a user has tried to ...
8
votes
3answers
602 views

Given CSRF protection, how can I deal with an extremely slow user?

We use a CSRF cookie on all of our forms that send data via HTTP POST. By default, the CSRF cookie out lives the session cookie by 2+ hours, in order to ensure it does not expire for users that still ...