How an application is kept secure to prevent unauthorized access.

learn more… | top users | synonyms

1
vote
1answer
22 views

Yahoo forbidden links

When I surf with my iPad or Mac, I find this message almost every day: This basically happens because Safari opens where you left, so I know the link is safe since it's a search I did at Yahoo ...
3
votes
3answers
73 views

Sharing link to software installer

When sharing a link to a software installer what is the preferred UX pattern, to share a link to a download page or a direct link to the downloadable executable? Using GIMP as an example... GIMP ...
3
votes
5answers
100 views

Lets the user set the password itself or send them one via mail after registration?

I have to built an order process for an energy provider. The order process is very big and the user needs 10-15 minutes to complete it with all the data. The last point is to set a password to access ...
5
votes
2answers
57 views

Best options for designing my own customised captcha-type process?

Okay, I've finally had enough of these stupid non-user-friendly Captcha images. Tonight I visited a site I had every intention of doing business with, but prior to being able to view the content (God ...
6
votes
5answers
120 views

Improving on the abcdef password

Ok please reserve judgement on this. This is somewhere between a security and a UX question, plus it might be too broad. I think my question can be summarised as: What's the best way to engage a ...
4
votes
4answers
76 views

How to emphasize that downloads may be a malicious to users?

These applications allow cyber security professionals to access files that are involved in reported malicious online incidents. This is the part of a larger service offering to these users. 99% of the ...
4
votes
2answers
723 views

Force log out users on applying a password policy?

Consider this use-case for an enterprise social network. Users have already signed up but after some time, the admin for the network decides to apply a password policy. Does applying a password ...
2
votes
0answers
62 views

Is there a best practice for allowing support rep to login to a user's account?

I'm updating a product that previously had a single checkbox to allow our support team to login to the user's account. Once in, the support rep had full admin level permissions. The product deals ...
6
votes
7answers
342 views

What is the best mobile number authorization strategy?

In recent years, mobile number has become an important factor for authentication and hence more and more enterprises employ methods to capture their users' mobile numbers using SMS. In a typical ...
0
votes
2answers
45 views

What's the most user-friendly way to circumvent encryption to enable password recoveries?

I have a web app. Users can use it to save people's contact details. These contact details are encrypted to ensure that they are difficult to get at if they're leaked. The encryption system is also ...
1
vote
3answers
66 views

What's the best way to validate an invited user via email that another user provided?

User 1 is an account administrator and can create (invite) other users on the account. User 1 inputs an email address for User 2. User 2 receives a welcome email at that address with a link to ...
3
votes
2answers
107 views

Am I supposed to lose everything else in my life when I lose my phone number? [closed]

Sorry, this isn't a coding or design problem, but it is a user-experience issue, and I'm looking for some kind of a discussion about it, and this is the best place I can come up with to discuss. I ...
1
vote
1answer
48 views

Site examples which allow users to expose password field [closed]

I'm looking for some real world sites where the login control allows users to view the text inside the password field. I'm looking for examples of site-generated "Show Password" controls, not examples ...
2
votes
1answer
43 views

How to prompt users to install app from supported source?

Sometimes, users find and install our app from unsupported sources. These alternative sources may have been tampered with. How should users be prompted to download the official app from the app ...
0
votes
2answers
61 views

Grouping Features permission

On the Wire-framing, you can see a list of sub-features under 'Accounts' and 'Products'. Manager and Accountants are the user roles. I am trying to figure how to reduce mental load by not showing ...
3
votes
3answers
170 views

Why warn about caps lock for passwords, instead of ignoring caps lock for password characters?

Many login screens warn the user if the caps lock key is switched on. Most prominently the windows login screen. Does this offer any advantage compared to simply ignoring the caps lock key and ...
0
votes
6answers
127 views

Should an ATM display the balance on-screen after transaction?

If an ATM could prompt users the summary of what they have done onscreen, would it be of any value in saving time, printer and paper?
0
votes
1answer
44 views

What's the best way to handle password reset requests where the user hasn't registered with the entered email address

Within a secure password reset function of a web application where the email address is the unique account identifier, what would be the best way to handle password reset requests where no matching ...
3
votes
1answer
118 views

UX Measures to protect users from phishing sites

I the last days I was thinking about possible solutions to protect your users from putting their data into forms on phishing websites and how you could warn them or "educate" them into not doing that. ...
3
votes
0answers
74 views

How should I allow Facebook-linked accounts to post anonymously? [closed]

I'm building a WordPress-based website where users will create an account from their Facebook account. Users will be able to post and comment but I'd like to offer the option for anonymous ...
4
votes
3answers
110 views

Correct UX for the scenario when a user forgets the answers to their security questions?

We have an application where a user is required upon registration to set up three security questions and answers When they login to the application, they must answer one of the questions after ...
3
votes
3answers
209 views

Reset password, appropriate response if email doesn't exist?

It is common on login forms to see "Email or password is incorrect" when the user types in their account details incorrectly instead of just "password is incorrect". This is, for among other reasons, ...
0
votes
1answer
68 views

Logging in with e-mail only

I've seen some websites (Medium, Basecamp 3, etc.) that require only an e-mail to sign up or log in to their app. Basically, you enter an e-mail, the app sends a one-off link to your e-mail, you click ...
7
votes
4answers
1k views

How best to securely present personal info in a members account page

I’m currently working on a utilities site for which signed up customers can access their personal information by means of an Account Page i.e. name, home address, email address, tel no. , billing ...
0
votes
0answers
45 views

Are UX designers, through UX design of web sites and apps, responsible for supporting the EU's directives regarding PII?

You can use the situation in this question as a use case. This is a summary. The designer is working on a fitness app which requires the user's age to function. The app does not require DOB to ...
1
vote
1answer
56 views

Verify authenticity of a digital ticket

Let's say there's an app for a fair. This fair has a bunch of vendors. The user sees the store catalog for each vendor and make purchases directly from the app. All he has to do is come and pick up ...
5
votes
3answers
164 views

How to communicate that an app never sends information to a server?

If you have an app that never sends any information to any server, what would be the best way to communicate this via the UI? Background: I produce an app that stores data chosen by the user, ...
1
vote
3answers
86 views

How to express that a form is part of a authenticity process?

I'm working on an app so user can ensure the products they are going to buy is not counterfeit and tracks its shipping. Tests To do so, we went for a form where people input a product's security ...
1
vote
4answers
78 views

What is a 'best-in-class' credential reset pattern?

When we design secure systems there is always a tension between memorability, security and cost (e.g. Calls to a call centre). Until recently, I've always tackled this by getting users to set up ...
2
votes
2answers
163 views

Why is it that almost all anti-virus software has custom built skins?

I am yet to see an anti-virus software that's using the native Windows theme. Why do they prefer custom skins over native windows skins? Does it have anything to do with security and/or consistency? ...
4
votes
5answers
293 views

Should editing a password be 2 step process or all in one form?

We have a web application whereby a user's profile screen uses a card-based layout. One of the cards allows users to update their password. Our team is split on how the password card should be laid ...
1
vote
3answers
107 views

When entering data, should the user be authenticated on clicking “Create” or “Save”?

Having the two options: Check if user authenticated upon "Save" button click (when the input dialog is shown and filled in with the data) Check if user authenticated upon "Create" button click ...
3
votes
2answers
123 views

Should a (permanent) password field show the correct amount of bullets of the entered password?

I'm working on an desktop program and noticed the following interface: Don't want to go into the details of the form, but basically, the user can enter an alternative username/password to login ...
50
votes
11answers
9k views

“Typocaptcha” - an alternative to CAPTCHA?

We all hate CAPTCHAs, but to some applications they're a necessary evil. Today I wondered if there's a better alternative we just haven't thought of yet. I considered the dilemma: how do you create ...
9
votes
3answers
446 views

Implementing a passphrase instead of a password

I was reading about UX and passwords to try to decide on explaining the requirements (ex: 1 capital letter, 1 number, 1 special character,eight characters) and came across this answer which sent me ...
1
vote
0answers
121 views

MarkDown Editor : Client side or Server Side or Both? [closed]

Planning to implement MarkDown Preview UI + Markdown Support for a chat application in development. Web framework is python-tornado MarkDown Lib i am looking is : remarkable (Faster than commonmark ...
1
vote
1answer
55 views

How should I visualize a name mismatch for a SSL website?

I am writing custom security software and need to design a better method for a name mismatch... where the server certificate doesn't match the address in the URL. How should I visualize this to the ...
1
vote
1answer
106 views

Hierarchical display of categories when the user is not exploring

We are making an in-house application intended for sharing know-how. It is a sensitive topic, because sharing with one's business partners makes work easier, but there are many (politically powerful) ...
1
vote
2answers
75 views

Dynamic Billing Information Validations In Checkout System

I'm unsure if this is more of a UX or security oriented question, but here goes nothing. I'm currently trying to simplify my e-store's checkout process by adding dynamic client side validations using ...
1
vote
3answers
99 views

Good way to help the user remembering the password strategy [duplicate]

Nowadays sites have different password strategies. In example: Facebook: 6 characters min, no restriction Ameli.fr: 8 characters min, all should be numbers. StackExchange: 8 characters min, upper ...
58
votes
3answers
5k views

Why do some websites (including Google) trim whitespaces in passwords?

I have just noticed that Google as well as some other sites trims the whitespaces in the password. I can successfully sign into my google account even if I add extra spaces in the end of my password. ...
5
votes
2answers
119 views

Using color and graphics to improve visualhostkey, and make comparing SHA256 hashes easier

I need anonymous end users to visualize hashed data, be it a Bitcoin Address (converted to the Sha256 hash it's based upon) File hash SSH key Since my target audience is normal consumers, and not ...
6
votes
4answers
372 views

How many atempts should you give a user before invalidating his password?

What I am trying to avoid here is brute force attacks on a user's password. And I am thinking about doing that by invalidating his password when too many attempts are made in the same minute, hour, ...
4
votes
1answer
130 views

Is there any research into whether/how people save username/password combinations?

It's something of an open secret that many people don't handle the security of their accounts online in the same way the designers of such systems would want them to. This is why we often see text ...
1
vote
1answer
165 views

How to encourage users to download an app to complete strong authentication (two factor)

I'm designing a strong authentication (two factor) solution for a website. Users will be forced to use two factor (legal requirement). We have two supported methods an SMS verification code texted to ...
2
votes
1answer
57 views

In Single Sign On what does SAML “enabled” control do or mean?

I am currently working on the redesign of SSO signup process/form and want to understand what enabling SAML control implies. The rationale being that if an organisation does not have SSO enabled the ...
91
votes
14answers
10k views

Should passwords expire?

I have a dispute with my partner. He comes from a financial software background but I do not. He recommends that our web app should expire user's passwords after 6 months (and it has to be unique each ...
0
votes
0answers
20 views

what is the best way for a user to securely share from a public device & app?

what is the best way for a user to securely share from a public device & app (kiosk-like), instead of just emailing to themselves under an anonymous user account? I need some UX advice and ...
1
vote
1answer
150 views

Inform user of invalid email on password reset

Should the user be told if they enter an email which is not in the database? User forgets their password and clicks a link to reset it. Page displays "An email was just sent out to youremail@bla.com ...
1
vote
2answers
107 views

Should I use multiple '*' when typing in one character?

I am designing a secure password login page. I am thinking about outputting multiple * for one typed character. For example: User types: a Password field shows: ****** My rationale for this is ...