How an application is kept secure to prevent unauthorized access.

learn more… | top users | synonyms

6
votes
3answers
130 views

How best to discuss the Heartbleed bug with users while keeping calm but getting action?

There are technical questions everywhere you look about Heartbleed. But none on not scaring the **** out of your users when discussing it, because lets be honest the news does a good job of scaring ...
28
votes
5answers
3k views

Does a password strength indicator increase password strength?

Just browsing the internet, I saw a password strength indicator on a sign up, and I realized that I personally didn't care. Does anyone know if, on average, password strength indicators increase the ...
0
votes
1answer
44 views

What makes a download link in email feel legit?

I'm creating a web app where users can provide snapshots of the page they are viewing and share them via email in a downloadable format. What are best practices for creating a sense of security for ...
1
vote
0answers
72 views

Is there a better way rather than forcing a double sign-in? Inspired by Youtube commenting by Google plus

This is an awkward question, combined with a irritated observation. Please forgive the irritated tone. I am very frustrated by the repeated messages I get on YouTube if I want to do as little as ...
1
vote
3answers
116 views

Should users see a 404 page if they are trying to view locked content?

If a user attempts to view a private repo on GitHub when they are not logged in, they get a 404 error page. Pro) It seems that the repo does not exist to those lacking proper access. This might help ...
1
vote
1answer
130 views

Why do some people physically cover their macbook cameras [closed]

Obviously, if a malicious user could save camera snapshots or streams you have a bigger issue on your hands than improperly lighted selfies. Or do they simply not get this / this isn't as commonly ...
1
vote
2answers
101 views

UX failure in Apple's security update process

It would have been much better if I could download the 700+ MB download in the background while continuing to work and THEN pull the trigger on applying the patch. There are no real reasons to couple ...
10
votes
3answers
870 views

Should I capture exceptions and present a nice error page to hackers? [closed]

If a hacker is trying to hack, should I present a pretty error page or redirect somewhere instead of a generic/cryptic error? I feel that the hacker knows what they are doing, I know what they are ...
8
votes
4answers
326 views

Should “Incorrect password” message show the password requirements of the current site? [duplicate]

I have a question that has been bothering me some time, let me illustrate my question with an example: I use multiple passwords in many applications and sometimes I forget what is the password for ...
1
vote
2answers
97 views

Should I show a customer granular credit card errors?

When credit cards are declined, our gateway usually provides a useful reason: insufficient funds, CVV mismatch, invalid card number, etc. Should we show this to the user? Or should we just show a ...
6
votes
9answers
541 views

Should password be set by users without security check?

I'm guessing if I should let my users choose their password without checking if there's at least 1 $pecial charact€r, 1 CAPLOCK, 1 numb3r... Shouldn't we just ask users to put a minimum of X ...
7
votes
2answers
249 views

How to portray to a user the security of an input field?

I was just tasked by my boss to make a certain SSN field to appear more secure. We currently are masking the first 5 numbers but he wants a greater feel of security behind the input. He was thinking ...
1
vote
3answers
265 views

What happens in a web browser when a download is started via Javascript?

In a web browser, a download can be initiated immediately after user input, or started via Javascript after a set amount of time and/or being redirected to another page. I want to provide users with ...
3
votes
2answers
211 views

secure banking apps

A while ago my bank introduced an online banking app. This allowed me to quickly access my bank account and make payments right from my phone with the best experience. In order to gain access to the ...
2
votes
4answers
104 views

How to increase trust and security feeling when collecting bank information

I have a site that needs to collect a user's bank username/password. This is obviously a big hurdle for someone to get over but we have to do that. I'm looking for ways, visually & textually, to ...
9
votes
4answers
196 views

Secure but still usable license key retrieval mechanism?

I just had a very interesting conversation with a support rep of a software product that I love (and which shall remain anonymous here). They use product keys for licensing, and in case the user ...
4
votes
3answers
113 views

Email address entry field on public kiosk system

Interesting discussion internally at this end re a sign-up/login mechanic that will be running within a public kiosk/display application. The question we have is related to whether or not we should ...
2
votes
5answers
215 views

What kind of user interface design practices can protect the information from someone who might be peeking at user's screen

What kind of UI design practices one could employ to protect the user's sensitive information from someone who might be looking (occasionally) at user's monitor from behind a shoulder or a nearby ...
3
votes
2answers
131 views

What is the recommended time before a reset password link expires?

I'm working on a financially leaning site and was curious — is there a standard amount of time to wait before expiring a reset password link once a user has forgotten his/hers and requested to reset ...
1
vote
1answer
502 views

Prevent Active Directory password expiration when user never logs in

Let's assume the following in a hospital: Each nurse has her own Active Directory user, with a password. The password expires automatically 90 days after the password was set. A nurse uses her own ...
2
votes
1answer
122 views

Implementing account lock out on a website

A web vulnerability scanner on my website made a suggestion that I implement an account lockout mechanism for my site when there has been a certain number of invalid login attempts. I am trying to ...
2
votes
1answer
202 views

May Facebook and Google+ login make a site feel 'insecure'?

Lets say I have a website which handles your money in some way. So I know about your credit cards. Currently, user register using their national identification number. So all the users are real ...
7
votes
5answers
248 views

“Locked” and “secure” icons in one interface

In case of a need to show both "locked" and "secure" icons on one element in an interface (let's say it is one of many tabs in an internet browser, where 'locked' and 'secure' refer to different ...
6
votes
3answers
708 views

Login for multiple users

What is the best way to make a login form for multiple users? I'll give you an example for your understanding: If we have three different type of users, for example, teachers, students and ...
0
votes
3answers
60 views

Contact us link: should a user be forced to log in right away?

Let's pretend we're a university optometry department and the tech support/contact us link on our website can be accessed by optometrists, their staff members, and patients alike. A patient is ...
0
votes
0answers
23 views

Is a marketing site served over https more trustworthy? [duplicate]

I've come across many product marketing websites in the past that are served over https (instead of plain http) when it wasn't technically neccessary. These sites, from what I could see, didn't show ...
8
votes
6answers
849 views

Childproof washing machine

My little boy (11 months old) has just discovered how the buttons and dials of the washing machine work. This is inconvenient, because the machine does not react well to random button mashing while ...
3
votes
3answers
136 views

On login forms, should user's email be remembered?

I'm having this discussion with a customer of mine, he wants me to pre-populate the user's email address on the login form, to make it easier to login, he does not want me to add a checkbox to have ...
2
votes
1answer
426 views

What's the advantage of disabling paste functionality for password input field? [duplicate]

Some web forms don't let the user paste text into password input fields. For example I just noticed this on Apple's iTunes Connect website: https://itunesconnect.apple.com/ I don't see any ...
26
votes
5answers
1k views

Should a user be logged in after resetting their password?

Lets assume following flow: I want to log in I don't remember password I click on the "forgot my password" link (email is dispatched) I check my inbox and click on the link I type in password and ...
3
votes
1answer
119 views

Unlock Account for Highly Secure Website

I am working on project for a very secure sensitive website in which the objective is to make the "unlock account" workflow easy and intuitive. Currently, if user enters wrong username and password ...
15
votes
4answers
1k views

What good is this moving captcha from Apple

A Hacker News article pointed me to http://www.apple.com/itunes/50-billion-app-countdown/entry-form/ where they use moving captchas: I assume that its a way to make shorter (and therefore ...
40
votes
10answers
4k views

Is a “Never tell your password to anyone” message in chat really necessary?

In almost every chat window I open, there's this fairly obvious statement: Never tell your [password/credit card/social security/etc] to anyone. Are there some standards for chat functionality that ...
1
vote
1answer
78 views

Installing recording software

On an upcoming visit to a user's place of work, I would like to have them install Morae Recorder beforehand. This is likely to be a problem for the user's IT Security people. In the past, especially ...
9
votes
2answers
207 views

Why would one limit username format?

Many websites when ask you to create a new "username", will limit you in some way, most often like "username should only contain letters and underscores" or something alike. This results in inability ...
23
votes
6answers
1k views

Forcing users to use a particular pattern for passwords

Many websites, specially government ones, enforce users to use a password which conforms to particular criteria. For example: use between 8-13 characters with at-least one integer and one capital ...
2
votes
3answers
530 views

How to make a user feel secure when using an iframe for payments

I've got a site where it's very difficult for me to add SSL, so I'm using a secure iframe on the payment page to collect credit card details. Currently it's set up to appear like it's the same site. ...
4
votes
1answer
80 views

Should link to restore user account lead him to login page?

Pinterest has a deactivate my account function. After user deactivates his account, he gets an email with Reactivate account link: Here Reactivate button links to login form with username and ...
4
votes
4answers
143 views

Security issues if not forcing a user to sign up

I've built a simple web app Flask.io that enables users to create and share to-do lists. It doesn't require sign up. This is an important differentiator. I don't want to force the user to register ...
5
votes
3answers
219 views

Should an admin decide what users can do, or should he decide what not to do?

Which one is better option for an admin from a usability point of view? Suppose if a system is supposed to authorize a user to have access (and different type of access like read only or read write) ...
3
votes
2answers
82 views

studies on passcode/keypad versus password/keyboard?

When designing a tablet-based app that needs it's own extra security, there seems to be a couple of common choices: add a password screen with a keyboard, or use a passcode screen that has a keypad. ...
5
votes
3answers
560 views

Input mask on credit card number & SSN

Our company is discussing the use of an input mask (asterisk) on credit card numbers and social security numbers. I'm completely against masking the CCN, from a UX perspective, especially since our ...
7
votes
2answers
239 views

Does inline validation at login create a security risk or a perception of one?

When a user types their email address into a login form, I'd like to validate inline whether the email is associated with an account. The idea here is that, in the system in question, a large ...
2
votes
4answers
110 views

Should you be allowed to change your own data?

Let's imagine you were about to use a CRM Enterprise-Application that contains your working-data (street, housenumber, office phone number and so on). Should we allow the user to change this data at ...
5
votes
3answers
187 views

Logging in with email only

I'm working on a blog and there will be an option to post a comment. I could implement registration with username, password and email — the standard way. I could implement 3rd-party authorization ...
2
votes
1answer
83 views

Can providing articles on security improve the perception users have of the security of a website?

I also know many who turns off scripting (JavaScript) from running on their system and won't open any website without HTTPS or any security protocol. Whenever I read about Facebook updating its ...
8
votes
2answers
282 views

how can you improve the appearance of security

What are the different ways to make users (especially paranoid one's like me) feel safe about the security aspect of the site?
1
vote
2answers
177 views

How does the perception of website data being insecure affect usability?

If the user perceives that data entered into a website is insecure (if it is perceived that it can be hacked, stolen or tampered with), how is the usability of the site affected? This question is in ...
3
votes
2answers
107 views

Login mechanism for multiuser smart-phones/tablet

What should be the mechanism for login in a shared smartphone or tablet? Should it be username + password as it is in PCs or should be enough using a password / PIN? I'm interested on both security ...
0
votes
1answer
78 views

Any good examples of a user signing up for a Browser Certificate / Client Certificate?

A client certificate is something that is used with TLS/SSL to increase security of the HTTPS session. There are two parts to this The user needs to create the certificate, have it approved (which ...