A secret word or string of characters that is used for authentication, to prove identity or gain access to a resource.

learn more… | top users | synonyms

9
votes
9answers
533 views

barebone registration: is password repitition and captcha really essential?

If you design a barebone registration form which only requires email address and password as essentials can you omit the password repetition and captcha without too much technical trouble? I ...
0
votes
2answers
165 views

Form for admins to to create users: include option for setting password or sending email to user so user can set their own password

I am creating a form that will allows dealers of my company's product to create user accounts for their customers. When creating a new account, they can either set the password with the form, or have ...
4
votes
2answers
265 views

Strategy for making easy remembered, easy typed and secure password for mobile devices?

I make great passwords which I remember in my fingers when I'm on a laptop keyboard. But when I turn to mobile devices, I lose my muscle memory on the soft keyboard. To overcome this problem, I store ...
1
vote
1answer
101 views

What is an example of a mobile app using an eye icon for showing the password in clear text

I am seeking an example to use in the 2nd Edition of the Mobile Design Pattern Gallery, O'Reilly Media 2014, but I cannot find the example I thought I had on hand. Can you think of any?
9
votes
3answers
972 views

Usability and security for user access and password handling in a web application?

I'm looking at putting together a website aimed at ordinary users that will handle personal data which I don't want to be compromised. How can I make the site secure but also usable? It seems most ...
3
votes
2answers
350 views

Remember Me in an enterprise application: What to remember?

I've just finished a well-thought login validation mechanism and have asked myself the following question several times: What does the user expect when he checks the Remember me checkbox in an ...
1
vote
1answer
250 views

Password protected content / Modal dialog or submission form up-front?

I'm working on a page, where a portion of the information is going to be protected by a password. Would it be beneficial to have text that says "Please enter password to view content" right up front ...
1
vote
1answer
1k views

Prevent Active Directory password expiration when user never logs in

Let's assume the following in a hospital: Each nurse has her own Active Directory user, with a password. The password expires automatically 90 days after the password was set. A nurse uses her own ...
1
vote
2answers
314 views

Password confirmation vs. email confirmation

Is it more advisable to ask a confirmation to the email or a confirmation to the password in a website registration form? I'm asking this because I saw this blog post that was featured on Hacker News ...
4
votes
2answers
720 views

What is the recommended time before a reset password link expires?

I'm working on a financially leaning site and was curious — is there a standard amount of time to wait before expiring a reset password link once a user has forgotten his/hers and requested to reset ...
0
votes
3answers
340 views

How should I show a password exists on an edit password form?

We're salting + hashing all of our passwords, but we allow the user the option to edit his/her password. However, we cannot retrieve the password to put the proper amount of asterisks into the ...
1
vote
1answer
80 views

Should a password change/reset log you out remotely?

I have a app with multiple frontends. (Web/Android/iOS). If you do a password reset/change at one of the frontends, should it log you out of other places? I don't want to make things hard for users, ...
46
votes
7answers
2k views

Designing a password/authentication system usable for young children in a classroom

We are all familiar with the best password practices for websites which will be used by adults, such as storing passwords in one-way hashes, using password resets instead of emailing password, etc. ...
8
votes
3answers
3k views

Patterns for sign-in & registration forms that show password as plain text (unmasked)?

Jakob Nielsen suggested it in 2009 (http://www.nngroup.com/articles/stop-password-masking/), and Luke W concurs (http://www.lukew.com/ff/entry.asp?1653), but are there any real-world implementations ...
2
votes
3answers
1k views

Is password confirmation necessary on a Change Password dialog?

On one hand there is no need to ask for password confirmation because it is annoying. If I made a mistake when confirming my password I'll need retype my very complex password again. There is also a ...
2
votes
4answers
1k views

How to show user login password is wrong after the first time e.g. flash “wrong password” message

This is a follow up to this question asking about what should be displayed when a user enters a wrong password. Here is my current design: when logging into a website if the user enters a wrong ...
2
votes
4answers
647 views

When registering should the passwords match/don't match still be shown if the initial password isn't strong enough

In a registration page the user is asked to enter a password. There are some (simple) rules for the password, so if the user enters "123" the text "password is too simple" will appear beside the input ...
5
votes
4answers
863 views

Forgotten passwords - should the temporary password expire?

Just designing the forgotten password form for a retailer. When researching other retailers, I've have noticed the temporary password link that gets sent to inbox's expire after a few hours. What is ...
11
votes
5answers
3k views

Is only having a single unmasked password field (no confirm) on a registration page a bad idea? [duplicate]

Some sites allow you to register and only provide a single password box, which is protected with stars. Traditionally a "confirm password" box is used when registering which allows you to confirm ...
5
votes
4answers
258 views

Login page & user parameters page: “password” field VS. “passphrase” field

For a secure application, we push users to use passphrases instead of passwords. We've got some explanations in the password change page. For the field, we use the label "passphrase" to push again the ...
27
votes
5answers
2k views

Should a user be logged in after resetting their password?

Lets assume following flow: I want to log in I don't remember password I click on the "forgot my password" link (email is dispatched) I check my inbox and click on the link I type in password and ...
43
votes
10answers
5k views

Is a “Never tell your password to anyone” message in chat really necessary?

In almost every chat window I open, there's this fairly obvious statement: Never tell your [password/credit card/social security/etc] to anyone. Are there some standards for chat functionality that ...
13
votes
5answers
2k views

Is it appropriate to display the warning message “Caps Lock is on”?

Is it appropriate to display the warning message "Caps Lock is on" when focus shifts to Password field? In gmail and yahoo I don't see it. So, what does the standard say?
2
votes
1answer
1k views

What's the advantage of disabling paste functionality for password input field? [duplicate]

Some web forms don't let the user paste text into password input fields. For example I just noticed this on Apple's iTunes Connect website: https://itunesconnect.apple.com/ I don't see any ...
2
votes
3answers
198 views

Forcing users to use a new password everytime they reset

This is getting common that while resetting one's password, web-applications force users not to use a password which they had used before. Just like forcing users to follow a particular pattern of ...
3
votes
1answer
175 views

Unlock Account for Highly Secure Website

I am working on project for a very secure sensitive website in which the objective is to make the "unlock account" workflow easy and intuitive. Currently, if user enters wrong username and password ...
8
votes
2answers
672 views

Why do most Create Account forms clear the password fields upon wrong validation? [duplicate]

In most Create Account forms that I've used, when you enter in something wrong (username not long enough, passwords don't match, invalid email, etc.), it'll keep all the fields but erase the password ...
3
votes
2answers
689 views

Display password Requirements on Login screen?

Some systems have complex password requirements. Because of this, it may be difficult to remember the password with a particular system. I understand that there may be security reasons for wanting to ...
7
votes
2answers
161 views

Masked password characters in a GUI vs terminal

In a GUI form, or for example a login box on a website, it's usual for masked characters to appear like ********* as you type out your password. But in terminal applications, for example ssh, this ...
5
votes
2answers
273 views

Password and in place editing

I decided to support in place editing for a simple user table. I am not sure what i should do about password... When i create a new user i can have a textbox to type... When viewing i can hide then ...
3
votes
2answers
127 views

studies on passcode/keypad versus password/keyboard?

When designing a tablet-based app that needs it's own extra security, there seems to be a couple of common choices: add a password screen with a keyboard, or use a passcode screen that has a keypad. ...
10
votes
4answers
2k views

Social Login adoption vs Traditional Login

I have implemented janrain's social login on my website. I am wondering how important it is to include a traditional login (email/password) system. I believe there may be a significant percentage of ...
6
votes
3answers
1k views

On log in form, what should a password unmask button look like and say?

On the log in form, I want to give users the option to unmask the password field so they can see what they type. The phrase "unmask password" is too technical and its purpose may not be apparent to ...
6
votes
5answers
990 views

Forgotten Passwords - is there a real benefit to asking for memorable password hints on signup?

On several signup forms I see fields such as "Choose your Memorable Password Question". Is this actually benifical nowadays? Surely a more secure method if someone forgets their password is to build a ...
14
votes
4answers
539 views

Is it good UX practice to have a website generate a password for the user?

Is it good UX practice to have a site generate secure random passwords for users and send it to their email or is it better to have them enter their own one each time?
14
votes
6answers
743 views

What is the best way to request individual characters from a password?

Frequently, sites that should really value security (especially banks) ask for several individual characters from a password. Typically I've seen them do it like this: download bmml source ...
29
votes
6answers
2k views

Forcing users to use a particular pattern for passwords

Many websites, specially government ones, enforce users to use a password which conforms to particular criteria. For example: use between 8-13 characters with at-least one integer and one capital ...
49
votes
17answers
8k views

Computer login with password only, without username

I have an idea to simplify the login screen on things like home computers with a small number of users (say, 2-10) with passwords. Today, a typical home computer's login screen has three steps: ...
4
votes
2answers
267 views

On login-failure; should site tell if it was the login-name or the password that was incorrect? [duplicate]

If a login fails; should the site explicitly tell the user if it was the username or the password that was wrong? or should it just tell that the combination of username/password was wrong (ie. no ...
0
votes
2answers
1k views

Why does the AppStore prompt the user for password for free apps? [closed]

This is something I've been thinking about for a while. Why does the App Store prompt the user for a password regardless whether the app is free or not? My theory is that of consistency; Since you ...
8
votes
2answers
1k views

Website registration/login process with highest success rate? [duplicate]

I'm looking for data about how to implement a registration and login process for a new website. We are currently considering four options: Login with email address and password that is stored in ...
20
votes
3answers
2k views

Should password fields have an unmask checkbox?

Is it a good idea to have an unmask checkbox for user selection when the users type their password to show them what they typed?
4
votes
1answer
6k views

Telling users passwords don't match and aren't strong enough

I have two functions in my user registration form One checks the password and confirmed password are the same. The other checks if the password is strong enough. I have two presentation related ...
4
votes
7answers
2k views

Is it good user experience to only require an email address at signup?

Is it a good idea to only require an email address from users at signup (without a password or other details)? After they sign up, we will send a random password to their email address; this password ...
2
votes
1answer
191 views

Best way to add account providers?

I briefly looked at spotify and I found that they use 2 providers: Themselves and facebook. Ie I can log in to spotify with facebook. But then it asks me for my spotify account when I downloaded the ...
5
votes
2answers
476 views

Best practice for overriding a pincode in a native iOS app?

I am working on the next version of an existing iPad app which has a pincode to lock admin functions. The current version has no means to override the pincode. We followed similar patterns and use ...
6
votes
3answers
3k views

How to show password reset option

In my website I put password recovery option hidden. I know there are two options to deal with it. Classical way, Show it as the next sentence to the register link. Example, "Want to try? Sign up ...
11
votes
2answers
2k views

Email confirmation on password reset?

I am building a prototype to a system that has a user account system in place. Of course with any account system, the user should be able to reset their password should the need arise (e.g., ...
16
votes
2answers
1k views

Should we send both username and password after registration?

After users have registered on a website, should that website send both username and password in their registration confirmation email ?
2
votes
1answer
158 views

Is it a good Idea to provide change password option on the login page?

I am reviewing a banking site and the site has change password link upfront on the login page with an option for old password and new password, which verifies the old password before changing to the ...