How an application is kept secure to prevent unauthorized access.
15
votes
4answers
632 views
What good is this moving captcha from Apple
A Hacker News article pointed me to http://www.apple.com/itunes/50-billion-app-countdown/entry-form/ where they use moving captchas:
I assume that its a way to make shorter (and therefore ...
30
votes
10answers
3k views
Is “Never tell your password to anyone” message in chat really necessary?
In almost every chat window I open, there's this fairly obvious statement:
Never tell your [password/credit card/social security/etc] to anyone.
Are there some standards for chat functionality that ...
1
vote
1answer
70 views
Installing recording software
On an upcoming visit to a user's place of work, I would like to have them install Morae Recorder beforehand. This is likely to be a problem for the user's IT Security people. In the past, especially ...
8
votes
2answers
162 views
Why would one limit username format?
Many websites when ask you to create a new "username", will limit you in some way, most often like "username should only contain letters and underscores" or something alike.
This results in inability ...
21
votes
6answers
870 views
Forcing users to use a particular pattern for passwords
Many websites, specially government ones, enforce users to use a password which conforms to particular criteria. For example: use between 8-13 characters with at-least one integer and one capital ...
2
votes
3answers
128 views
How to make a user feel secure when using an iframe for payments
I've got a site where it's very difficult for me to add SSL, so I'm using a secure iframe on the payment page to collect credit card details.
Currently it's set up to appear like it's the same site. ...
4
votes
1answer
57 views
Should link to restore user account lead him to login page?
Pinterest has a deactivate my account function.
After user deactivates his account, he gets an email with Reactivate account link:
Here Reactivate button links to login form with username and ...
4
votes
4answers
118 views
Security issues if not forcing a user to sign up
I've built a simple web app Flask.io that enables users to create and share to-do lists.
It doesn't require sign up. This is an important differentiator. I don't want to force the user to register ...
5
votes
3answers
205 views
Should an admin decide what users can do, or should he decide what not to do?
Which one is better option for an admin from a usability point of view?
Suppose if a system is supposed to authorize a user to have access (and different type of access like read only or read write) ...
3
votes
2answers
67 views
studies on passcode/keypad versus password/keyboard?
When designing a tablet-based app that needs it's own extra security, there seems to be a couple of common choices: add a password screen with a keyboard, or use a passcode screen that has a keypad.
...
3
votes
3answers
241 views
Input mask on credit card number & SSN
Our company is discussing the use of an input mask (asterisk) on credit card numbers and social security numbers.
I'm completely against masking the CCN, from a UX perspective, especially since our ...
7
votes
2answers
136 views
Does inline validation at login create a security risk or a perception of one?
When a user types their email address into a login form, I'd like to validate inline whether the email is associated with an account. The idea here is that, in the system in question, a large ...
2
votes
4answers
100 views
Should you be allowed to change your own data?
Let's imagine you were about to use a CRM Enterprise-Application that contains your working-data (street, housenumber, office phone number and so on).
Should we allow the user to change this data at ...
5
votes
3answers
160 views
Logging in with email only
I'm working on a blog and there will be an option to post a comment.
I could implement registration with username, password and email — the standard way. I could implement 3rd-party authorization ...
2
votes
1answer
60 views
Can providing articles on security improve the perception users have of the security of a website?
I also know many who turns off scripting (JavaScript) from running on their system and won't open any website without HTTPS or any security protocol. Whenever I read about Facebook updating its ...
8
votes
2answers
175 views
how can you improve the appearance of security
What are the different ways to make users (especially paranoid one's like me) feel safe about the security aspect of the site?
1
vote
2answers
118 views
How does the perception of website data being insecure affect usability?
If the user perceives that data entered into a website is insecure (if it is perceived that it can be hacked, stolen or tampered with), how is the usability of the site affected?
This question is in ...
3
votes
2answers
76 views
Login mechanism for multiuser smart-phones/tablet
What should be the mechanism for login in a shared smartphone or tablet? Should it be username + password as it is in PCs or should be enough using a password / PIN?
I'm interested on both security ...
0
votes
1answer
58 views
Any good examples of a user signing up for a Browser Certificate / Client Certificate?
A client certificate is something that is used with TLS/SSL to increase security of the HTTPS session. There are two parts to this
The user needs to create the certificate, have it approved (which ...
42
votes
17answers
5k views
Computer login with password only, without username
I have an idea to simplify the login screen on things like home computers with a small number of users (say, 2-10) with passwords.
Today, a typical home computer's login screen has three steps:
...
4
votes
3answers
192 views
Norton Safe Web Verification — Impact on User
I have a client who insists on getting their website validated by Norton Security Verification and displaying the seal. However, I am skeptic and do not trust Norton products. I recall an impression ...
4
votes
3answers
198 views
Should we ask for name on card even though it's not required for credit card payments?
The name on card is not used when processing credit card payments. Paypal does not ask the user to enter the name on card when saving a card to the "wallet", while Amazon.com does.
The benefit of ...
8
votes
6answers
342 views
How to handle “forgot password” when user has not confirmed email?
If you follow the pattern of allowing users access to your application without having confirmed an email (generally considered good UX), how do handle the case where they forgot their password? Very ...
0
votes
1answer
42 views
Can you use similar security questions used on email registration for a more corporate tool?
I am developing a set of security questions for a corporate website. The usual security questions I come across are mothers birthplace, best childhood friend, ect. These questions don't seem fitting ...
2
votes
3answers
184 views
Limiting access before email address is confirmed
I'm making a directory site and I'm considering having the following setup for email confirmation:
After registering, user has x hours to confirm their email. They're sent immediately to the next ...
8
votes
1answer
219 views
Why does MediaWiki put little padlocks on HTTPS links?
Does anyone know why MediaWiki puts little padlock icons next to HTTPS links? For example, if I put this link in a wiki article: https://twitter.com/harry_wood it would get a little yellow padlock by ...
2
votes
0answers
150 views
How to provide good mobile phone number verification? [closed]
I'd like to know if there is a way to achieve a good user experience when a user's profile contains a mobile number which needs to be verified via SMS.
The examples I have explored had the mobile ...
3
votes
3answers
155 views
Case sensitive vs case insensitive passwords
My website has always used case insensitive passwords for millions of users. The security specialist is pushing us to change to case sensitive passwords. Are there any studies or best practices on ...
0
votes
0answers
43 views
How are Audio Captchas created? [closed]
How are Audio Captchas created?
Is there a service provides the audio Catpchas that blind people complete when filling out a Captcha?
Is there a 3rd party service or do each provider make their ...
15
votes
5answers
881 views
Should I use two steps or one when users change password?
I currently have a page dedicated to changing passwords. There are 2 options:
A 2 step option:
download bmml source – Wireframes created with Balsamiq Mockups
download bmml ...
5
votes
2answers
93 views
What are the conventions for how often a user should be asked to log into a mobile application?
Or put another way - is there a process for deciding how long a user's authenticated session should last?
4
votes
1answer
84 views
Encryption of chat messages and possibility of password loss
I have a client-server chat like app. I would like to add an encryption of messages for users. So, that they will be sure that no one, even service owner, can read their confidential information. I'm ...
3
votes
1answer
113 views
Are there specific standards, guidelines, and processes UX in security?
There are a number of resources with well-defined standards and practices for UX, and there are principles in security relevant to UX such as the principle of Psychological Acceptability. However, as ...
4
votes
2answers
212 views
Forgot Password Alternatives?
Does anyone know of a good alternative to the Forgot Password link on login forms? I'm not looking to eliminate the link, but to provide an alternate method for retrieving lost passwords.
Our current ...
6
votes
2answers
246 views
Should we require confirmation before resetting a password?
If a user has forgotten their password for a service, the convention is that they should need only their username and/or registered email address in order to reset their password -- in our case that ...
11
votes
4answers
474 views
When is it right to use “Not <user>?”
Sometimes a site shows a message reading: "You are logged in as [user1]. Not [user1]? Please log out."
When is it right to use such a thing? Where are we assuming someone is mistakenly logged in as ...
2
votes
2answers
63 views
How to best inform user they cant use the service for a period of time after registering?
For security reasons, after registering we cant let the user actually use the product until 14 days have past.
Right now I'm just appending a message at the end of the form (Ann#3) - is there a ...
5
votes
2answers
171 views
How can I reassure users about an unfamiliar domain name?
I have a service, example-service.com.
I have customers customer-a.com, customer-b.com, etc.
We host a service for them on urls like customer-a.example-service.com
Users who are familiar with ...
8
votes
3answers
487 views
Why did they use two-stage social media sharing buttons?
I recently visited a seemingly fairly reputable web site and was astonished to see their implementation of a two-stage trigger for their social media buttons:
(The text appears when you hover over ...
47
votes
10answers
4k views
Refusing a user permission to click a URL
I've been asked to work on a system message on an intranet where by there are various URLs (linking to lists of content) that have permission rights attached to them, so only certain users have access ...
5
votes
1answer
173 views
Usable examples, recommended practices for interfaces optimized for using pass-phrases instead of passwords
Reading through What is the best way to inspire users to choose strong password?, I realized I have never used an interface where the primary login password system would use pass-phrases (and where ...
42
votes
10answers
2k views
What is the best way to inspire users to choose strong password?
Most of the users use weak passwords. They may use weak passwords even for services where they store sensitive information. I think it's because they don't believe that their password may be ...
7
votes
1answer
177 views
During sign ups, how to best instill confidence that email addresses will be safe
Many sign up forms will ask you for an email address so that they can contact you.
Even the most minimal sign-up (other than no sign up) will need an email address to send you a validation email.
...
16
votes
6answers
463 views
Should validating an email automatically sign someone into an application?
When signing up for a new account with a web application, it is standard to send a validation email. I don't want to go into the pros and cons of the validation email though.
When receiving a ...
1
vote
1answer
86 views
Is there an established way of representing Single Sign On with an icon? [closed]
I'm wracking my brains trying to think of representing Single Sign On iconographically. Is there a common way this is done?
0
votes
2answers
268 views
Usability vs. Security [closed]
This question has started to preoccupy since read Stevey's Google Platforms Rant by Steve Yegge. (The original post was removed.) Among many other things he asserts that usability is more important ...
0
votes
2answers
108 views
User testing browser add-on
I'm working on a browser add-on that has some novel usability ideas, and I'd like to test them out on some users. The add-on interacts with the user's password data and usage, and I'd like to collect ...
5
votes
1answer
138 views
What is the benefit of fixed security questions?
Many sites/services seem to make use of a security question as a way of accessing an account if you lose your password or email access.
As an example, Facebook uses this form:
There isn't a ...
5
votes
5answers
489 views
Forgotten Passwords - is there a real benefit to asking for memorable password hints on signup?
On several signup forms I see fields such as "Choose your Memorable Password Question". Is this actually benifical nowadays? Surely a more secure method if someone forgets their password is to build a ...
14
votes
8answers
2k views
How to tell the user his login credentials are incorrect?
When a user has entered incorrect details into a login form, is it better to tell them:
The username or password you have entered is invalid.
or
The user name you have entered is invalid (for ...
