Tagged Questions

A secret word or string of characters that is used for authentication, to prove identity or gain access to a resource.

learn more… | top users | synonyms

0
votes
1answer
48 views

Are there any good guidelines to how many passwords a user can safely remember?

In an ideal world we each would have one password to remember, and that would be a strong password and we would change it every month or so. But we don't live in an ideal world, and we have to access ...
0
votes
3answers
79 views

When should I validate that the password in a confirmation field matches the first password entered?

If a user creation page has a field where you are asked to re-enter your password, when should the page validate that the second password matches the first? I do not have control over whether or not ...
1
vote
1answer
27 views

Automatic login on password reset

This question has been raised on http://security.stackexchange.com/questions/40723/why-do-you-need-to-login-after-you-change-a-password - With security in mind As one user states: "From a security ...
-2
votes
1answer
64 views

Username & Password for selling page Yes or No?

I appreciate your given opinion about this: I intend to send an email to a specific target audience in order to offer small business owners (around the world) a product which is not cheap. (I don't ...
1
vote
4answers
128 views

“My account” page mockup - change password form on this page?

I am mocking up a very minimalistic user-account page. It consists of just three functions - a counter that displays your available uses, field to redeem a code and a link to a form where you can ...
4
votes
2answers
128 views

Change Password Form

When allowing a user to change their password is it necessary to add a confirm password field? as follows: Current Password New Password Password Strength Meter Confirm New Password (Is this field ...
1
vote
1answer
380 views

Best practices for picture password implementation

Instead using of the conventional password design (***** in a text entry field) in my mobile application, I've been thinking about letting the user create a 4 item password from a collection of 10 ...
1
vote
2answers
83 views

Does a crime security alert app need its users to register?

I was asked to work on a police security alert system as a school project. The app notifies a user about security info and lets users (citizens of a place) notify police agencies around them. I was ...
3
votes
1answer
142 views

Show special keyboard view when entering a password on mobile devices?

Mobile operating systems typically show different virtual keyboards depending on context. The default keyboard might show A-Z, while a keyboard for entering a telephone number might show 0-9 (so you ...
0
votes
1answer
96 views

Security questions vs secret password/passcode when logging in or retrieving login details?

I am currently in the process of re-designing a login process which uses security questions to verify the identity of users before they are successfully logged in, and also to allow them to reset ...
1
vote
1answer
58 views

Registration form inline password generation?

A client has given me "design direction" for their site's account creation form (it's a utility site) that includes an option to have the system generate a password for the user inline on the form, ...
1
vote
1answer
75 views

“Change password”, “change your password” or “pick a new password”?

I have seen these different phrases on various websites and I was wondering which one sounds warmer, more inviting and more trustworthy? Which is more user-friendly? Personally I don't understand ...
1
vote
3answers
101 views

Should ergonomics be added to password strength meters?

After getting locked out of my account for typing in my password incorrectly several times in a row, I realized that the password I chose is too prone to typos and has resulted in locked accounts. It ...
0
votes
1answer
55 views

Password recovery process: temporal password vs. change it yourself

I'm looking for analyzing if giving a temporal password when some user forgets its actual password and requires to log into an application (in my case, it's a Web application) is a good idea. From my ...
1
vote
1answer
99 views

Reverse and optimize the sign up process for double opt-in

The perceived majority of websites have a quite similar approach to double opt-in signups: all information required to sign up is required before sending a confirmation e-mail. The confirmation e-mail ...
4
votes
6answers
313 views

Wouldn't it be a good UX practice to give hints to users to help them remember their passwords?

Although most of the places on the internet allow users to login with their existing Google or Facebook account, there are still many places where this is not an option. In such cases, remembering ...
2
votes
2answers
111 views

Forcing Users To think up More Complex Passwords / Ease of Remembering Them

Are there any guidelines on the play-off between forcing users to have complex passwords (longer, including numbers and special characters etc) - and the reduction in security if users therefore have ...
1
vote
1answer
187 views

Password reset with lost email functionality

I have searched and viewed most of the other questions and answers about implementing forgot password functionality on a website. However, we have a unique situation. When a user registers an account ...
1
vote
1answer
83 views

What is a Design pattern for “Remember Me” that forces user to explicitly choose “remember” or "do not remember?

We have a very nontechnical user base. We provide a "Remember Me on this computer" option (checked by default) but perhaps it should not be checked by default. However, I want to make sure they have ...
1
vote
1answer
47 views

Passwords: Speed of conversion from displayed to 'starred'

On an Android phone, passwords are automatically converted to a 'starred' format a few seconds after each character is input. However I find this happens too quickly to visually double check that I ...
1
vote
2answers
81 views

Potential UX issues with password-less logins?

There is a fantastic article entitled Is it time for password-less login? that suggests that we could use the "reset password" link as the default login action to any site. It provides a lot of ...
0
votes
1answer
74 views

Optional password field on login

We want all users to enter their employment ID so we can identify them, but it's not so important that we require them to register or remember a password. Some users will be registered for the ...
2
votes
3answers
110 views

When is the best time to ask a user to create a password?

I have seen some services ask the user to create a password on the initial signup form. I have seen others only ask the user to create a password after clicking on a verification link sent to their ...
9
votes
2answers
146 views

Variable Password Requirements Help

Standford University recently published a quick guide to their password requirements: While I quite like this method and this guide is great, I can't think of a nice way to concisely express this ...
4
votes
4answers
132 views

Should password complexity be shown at login page?

I believe most (or at least: many) users have passwords pretty much standard - they tend to use even literally the same password for most of the systems they access. This is insecure, of course, but ...
34
votes
10answers
5k views

Is it good idea to send user password upon register?

I can imagine both ways - send / not send and still make it secure enough inside application. For instance: I get the password from "Enter your password" field, store it in email template and then ...
2
votes
2answers
257 views

Logout after password change?

What is the convention regarding the following scenario: In a given system, a user is already logged in. He perform some tasks and then he change his own password. After this point, what should ...
2
votes
1answer
92 views

Changing password in user settings. Best method

I'm trying to think of the 'best' way for a user to change its password along with its user settings(Like name, e-mail etc.) I've got a form like this: Name: [text input] E-mailaddress: [text input] ...
33
votes
14answers
4k views

Argument for/against splitting login process into checking username, then ask password?

My boss has insisted for a while that our login process be divided into two steps on separate pages: on the first page, ask the user's e-mail address. On the second page, either display "user found" ...
2
votes
3answers
292 views

Which browsers allow users to reveal passwords in password fields?

Which browsers allow users to reveal passwords in password fields? I already know that Windows 8, Windows 8.1, Internet Explorer 10 and Internet Explorer 11 (1). Cursory research did not reveal any ...
10
votes
4answers
1k views

Allowing every password of 6+ characters. Good practice?

I am developing a file sharing and hosting service, and right now I don't have any requirements set other then that a password has to be at least 6 characters long. I also accept all characters. I'm ...
4
votes
1answer
108 views

Forgot password— show the rules for that passphrase? [duplicate]

I know there's been a lot of discussion about password strength and indicators when signing up. I often find that when I forget a password for a site, its because I can't remember which set of rules ...
3
votes
2answers
128 views

Password Complexity Requirements

Anyone has research or data that shows correlation between using password complexity requirements and sign up conversion rate? Example of password complexity requirement:
34
votes
5answers
4k views

Does a password strength indicator increase password strength?

Just browsing the internet, I saw a password strength indicator on a sign up, and I realized that I personally didn't care. Does anyone know if, on average, password strength indicators increase the ...
3
votes
3answers
138 views

Is it a bad idea to not allow users to register with an easy to guess password?

We all know them: password, password123, and letmein are all fairly common passwords and are easy to guess. Still, people use them. Would it be a bad idea to not allow users to use common passwords? I ...
3
votes
2answers
306 views

Show a password strength indicator without text?

Do people know what it means when there is a coloured bar that shows up below their password as they type? The users that will be using this form will be from all over the world and most likely ...
0
votes
1answer
100 views

Forgotten username, password or both

I am having some trouble with the wording of the following: Forgotten your Username or Password? Both? Where Username, Password and Both are links. Is there a need for the Both option or ...
1
vote
3answers
201 views

Best way to handle email verification before checking the user's password?

I'm creating an online service that requires users to sign in with their email address, and before they can sign in on a new device, they have to confirm it with an email message in their inbox. The ...
6
votes
9answers
620 views

Should password be set by users without security check?

I'm guessing if I should let my users choose their password without checking if there's at least 1 $pecial charact€r, 1 CAPLOCK, 1 numb3r... Shouldn't we just ask users to put a minimum of X ...
4
votes
2answers
204 views

Strategy for making easy remembered, easy typed and secure password for mobile devices?

I make great passwords which I remember in my fingers when I'm on a laptop keyboard. But when I turn to mobile devices, I lose my muscle memory on the soft keyboard. To overcome this problem, I store ...
1
vote
1answer
67 views

What is an example of a mobile app using an eye icon for showing the password in clear text

I am seeking an example to use in the 2nd Edition of the Mobile Design Pattern Gallery, O'Reilly Media 2014, but I cannot find the example I thought I had on hand. Can you think of any?
3
votes
6answers
1k views

Is it necessary to verify a user's email address?

It's pretty much a fact that users hate having to open a new tab, go to their email service, log in, wait for the email to arrive and then click a link/paste a code. Is it really necessary to do this ...
1
vote
1answer
115 views

Password protected content / Modal dialog or submission form up-front?

I'm working on a page, where a portion of the information is going to be protected by a password. Would it be beneficial to have text that says "Please enter password to view content" right up front ...
1
vote
2answers
229 views

Password confirmation vs. email confirmation

Is it more advisable to ask a confirmation to the email or a confirmation to the password in a website registration form? I'm asking this because I saw this blog post that was featured on Hacker News ...
3
votes
2answers
208 views

What is the recommended time before a reset password link expires?

I'm working on a financially leaning site and was curious — is there a standard amount of time to wait before expiring a reset password link once a user has forgotten his/hers and requested to reset ...
1
vote
1answer
64 views

Should a password change/reset log you out remotely?

I have a app with multiple frontends. (Web/Android/iOS). If you do a password reset/change at one of the frontends, should it log you out of other places? I don't want to make things hard for users, ...
1
vote
1answer
871 views

Prevent Active Directory password expiration when user never logs in

Let's assume the following in a hospital: Each nurse has her own Active Directory user, with a password. The password expires automatically 90 days after the password was set. A nurse uses her own ...
7
votes
3answers
2k views

Patterns for sign-in & registration forms that show password as plain text (unmasked)?

Jakob Nielsen suggested it in 2009 (http://www.nngroup.com/articles/stop-password-masking/), and Luke W concurs (http://www.lukew.com/ff/entry.asp?1653), but are there any real-world implementations ...
1
vote
3answers
93 views

UI for a sign-in screen which allows to log in with a username or phone number

I have a sign-in screen which allows a user to log in with a username or a phone number. As the phone number must be in an "international" format, it confuses users, some of them fail to sign in. To ...
0
votes
3answers
208 views

How should I show a password exists on an edit password form?

We're salting + hashing all of our passwords, but we allow the user the option to edit his/her password. However, we cannot retrieve the password to put the proper amount of asterisks into the ...