How an application is kept secure to prevent unauthorized access.

learn more… | top users | synonyms

1
vote
3answers
68 views

Good way to help the user remembering the password strategy [duplicate]

Nowadays sites have different password strategies. In example: Facebook: 6 characters min, no restriction Ameli.fr: 8 characters min, all should be numbers. StackExchange: 8 characters min, upper ...
53
votes
3answers
5k views

Why do some websites (including Google) trim whitespaces in passwords?

I have just noticed that Google as well as some other sites trims the whitespaces in the password. I can successfully sign into my google account even if I add extra spaces in the end of my password. ...
5
votes
0answers
69 views

Using color and graphics to improve visualhostkey, and make comparing SHA256 hashes easier

I need anonymous end users to visualize hashed data, be it a Bitcoin Address (converted to the Sha256 hash it's based upon) File hash SSH key Since my target audience is normal consumers, and not ...
6
votes
4answers
230 views

How many atempts should you give a user before invalidating his password?

What I am trying to avoid here is brute force attacks on a user's password. And I am thinking about doing that by invalidating his password when too many attempts are made in the same minute, hour, ...
2
votes
1answer
71 views

Is there any research into whether/how people save username/password combinations?

It's something of an open secret that many people don't handle the security of their accounts online in the same way the designers of such systems would want them to. This is why we often see text ...
0
votes
1answer
45 views

How to encourage users to download an app to complete strong authentication (two factor)

I'm designing a strong authentication (two factor) solution for a website. Users will be forced to use two factor (legal requirement). We have two supported methods an SMS verification code texted to ...
2
votes
1answer
39 views

In Single Sign On what does SAML “enabled” control do or mean?

I am currently working on the redesign of SSO signup process/form and want to understand what enabling SAML control implies. The rationale being that if an organisation does not have SSO enabled the ...
86
votes
14answers
9k views

Should passwords expire?

I have a dispute with my partner. He comes from a financial software background but I do not. He recommends that our web app should expire user's passwords after 6 months (and it has to be unique each ...
0
votes
0answers
9 views

what is the best way for a user to securely share from a public device & app?

what is the best way for a user to securely share from a public device & app (kiosk-like), instead of just emailing to themselves under an anonymous user account? I need some UX advice and ...
0
votes
1answer
62 views

Inform user of invalid email on password reset

Should the user be told if they enter an email which is not in the database? User forgets their password and clicks a link to reset it. Page displays "An email was just sent out to youremail@bla.com ...
1
vote
2answers
98 views

Should I use multiple '*' when typing in one character?

I am designing a secure password login page. I am thinking about outputting multiple * for one typed character. For example: User types: a Password field shows: ****** My rationale for this is ...
0
votes
2answers
57 views

Impact of images and icons on user perception when capturing personal information?

I am designing an account area where users are required to provide some personal information.I have came across research that suggests that the use of icons such as a "Padlock" or similar has a ...
0
votes
1answer
81 views

Are there any good guidelines to how many passwords a user can safely remember?

In an ideal world we each would have one password to remember, and that would be a strong password and we would change it every month or so. But we don't live in an ideal world, and we have to access ...
2
votes
1answer
59 views

Automatic login on password reset

This question has been raised on http://security.stackexchange.com/questions/40723/why-do-you-need-to-login-after-you-change-a-password - With security in mind As one user states: "From a security ...
3
votes
2answers
52 views

What do you do when the user interrupts the purchase process?

If a user on an e-commerce site is in the middle of a purchase process when they leave to another part of the site, or perhaps leave the site completely, what information should be retained if they ...
1
vote
1answer
29 views

How best to provide contact info in a member directory while preventing 'data harvesting'?

I am working on a searchable online directory. People will use it to find other members, service providers, and the like. It's critical that the results include contact data. However, my clients are ...
0
votes
2answers
76 views

Why does verizon have me confirm my authorization code when adding a device? [closed]

What purpose does the second entry serve? Why are they making us go through the hassle of entering in a random character string twice, when we can clearly see it the first time we type it in?
1
vote
2answers
86 views

Does a crime security alert app need its users to register?

I was asked to work on a police security alert system as a school project. The app notifies a user about security info and lets users (citizens of a place) notify police agencies around them. I was ...
0
votes
1answer
116 views

Security questions vs secret password/passcode when logging in or retrieving login details?

I am currently in the process of re-designing a login process which uses security questions to verify the identity of users before they are successfully logged in, and also to allow them to reset ...
2
votes
1answer
39 views

Is there a standard for informing users about SSL/HTTPS on Android/iOS?

On a standard web browser it's very easy to see how your data is being transferred to servers via the padlock icon and tools like Firebug or Chrome dev can give you the information for things like ...
16
votes
2answers
2k views

Does the padlock icon make users perceive your site as safer?

I was recently in a discussion with one of our developers about the usage of padlock icons (not on the https link) in user interfaces. I remember encountering the icon in lots of different ...
2
votes
1answer
112 views

Prompting customer login before making changes to their account

In a project I'm working on, there's a service website where customers can register objects they own in order to use the service. If a customer owns many of these objects, all can be registered on the ...
0
votes
1answer
122 views

How to manage credentials information to the user?

I've created a plugin for an editor. This plugin gets some information from the project and shows you all the related issues, getting the information from an external application (Github, gitlab, ...
24
votes
6answers
3k views

Why do financial institutions use usernames instead of emails for login?

I'm redesigning an application and I'm researching the use of email vs username login options. Our application works with financial institutions and because of this have been told that usernames are ...
1
vote
1answer
215 views

Best practice for two-step verification process

Perhaps due to the recent incidents behind hacking of user database and identity theft, many organizations have introduced the two-step verification process, in particular when users are accessing the ...
12
votes
4answers
4k views

Stop user opening links in a new tab

On a secure site, is it OK to stop users from opening a link in a new tab by signing them out? I have a mobile games web-app and my users can only play one at a time. To avoid issues of them trying ...
0
votes
2answers
493 views

Why do some cars only have a physical lock on the driver side?

I have a car (tsx) and I realize that sometimes I will need to use the physical key instead of the electronic key fob to unlock my car. Such as if there is something wrong with the electronics or my ...
0
votes
1answer
78 views

What's the best type of car key? [closed]

Everyone is familiar with the regular physical key and lock for their car. But nowadays, new cars have all kinds of fancy key fob systems to lock and unlock their car. But what is the best in terms ...
0
votes
1answer
84 views

Optional password field on login

We want all users to enter their employment ID so we can identify them, but it's not so important that we require them to register or remember a password. Some users will be registered for the ...
1
vote
1answer
53 views

displaying the actual encrypted data or replace its value with wild card

So we have a column on a table where we display different user names and their recent daily activities. The admin has the option to encrypt the actual user names due to privacy concerns. The current ...
9
votes
2answers
158 views

Variable Password Requirements Help

Standford University recently published a quick guide to their password requirements: While I quite like this method and this guide is great, I can't think of a nice way to concisely express this ...
34
votes
10answers
5k views

Is it good idea to send user password upon register?

I can imagine both ways - send / not send and still make it secure enough inside application. For instance: I get the password from "Enter your password" field, store it in email template and then ...
2
votes
1answer
59 views

Should Operating Systems Hide Sizes of Files/Folders the User is Denied Access to?

If there are files or folders the current user should be denied access to, should their sizes be displayed when the user asks, for example with the ls -l command on Linux or the places the Windows ...
3
votes
3answers
490 views

Which browsers allow users to reveal passwords in password fields?

Which browsers allow users to reveal passwords in password fields? I already know that Windows 8, Windows 8.1, Internet Explorer 10 and Internet Explorer 11 (1). Cursory research did not reveal any ...
11
votes
4answers
1k views

Allowing every password of 6+ characters. Good practice?

I am developing a file sharing and hosting service, and right now I don't have any requirements set other then that a password has to be at least 6 characters long. I also accept all characters. I'm ...
7
votes
3answers
172 views

How best to discuss the Heartbleed bug with users while keeping calm but getting action?

There are technical questions everywhere you look about Heartbleed. But none on not scaring the **** out of your users when discussing it, because lets be honest the news does a good job of scaring ...
34
votes
5answers
4k views

Does a password strength indicator increase password strength?

Just browsing the internet, I saw a password strength indicator on a sign up, and I realized that I personally didn't care. Does anyone know if, on average, password strength indicators increase the ...
0
votes
1answer
65 views

What makes a download link in email feel legit?

I'm creating a web app where users can provide snapshots of the page they are viewing and share them via email in a downloadable format. What are best practices for creating a sense of security for ...
3
votes
4answers
501 views

Is there a better way rather than forcing a double sign-in? Inspired by Youtube commenting by Google plus

This is an awkward question, combined with a irritated observation. Please forgive the irritated tone. I am very frustrated by the repeated messages I get on YouTube if I want to do as little as ...
2
votes
3answers
311 views

Should users see a 404 page if they are trying to view locked content?

If a user attempts to view a private repo on GitHub when they are not logged in, they get a 404 error page. Pro) It seems that the repo does not exist to those lacking proper access. This might help ...
2
votes
1answer
257 views

Why do some people physically cover their macbook cameras [closed]

Obviously, if a malicious user could save camera snapshots or streams you have a bigger issue on your hands than improperly lighted selfies. Or do they simply not get this / this isn't as commonly ...
1
vote
2answers
120 views

UX failure in Apple's security update process

It would have been much better if I could download the 700+ MB download in the background while continuing to work and THEN pull the trigger on applying the patch. There are no real reasons to couple ...
11
votes
3answers
1k views

Should I capture exceptions and present a nice error page to hackers? [closed]

If a hacker is trying to hack, should I present a pretty error page or redirect somewhere instead of a generic/cryptic error? I feel that the hacker knows what they are doing, I know what they are ...
8
votes
4answers
428 views

Should “Incorrect password” message show the password requirements of the current site? [duplicate]

I have a question that has been bothering me some time, let me illustrate my question with an example: I use multiple passwords in many applications and sometimes I forget what is the password for ...
1
vote
2answers
341 views

Should I show a customer granular credit card errors?

When credit cards are declined, our gateway usually provides a useful reason: insufficient funds, CVV mismatch, invalid card number, etc. Should we show this to the user? Or should we just show a ...
6
votes
9answers
676 views

Should password be set by users without security check?

I'm guessing if I should let my users choose their password without checking if there's at least 1 $pecial charact€r, 1 CAPLOCK, 1 numb3r... Shouldn't we just ask users to put a minimum of X ...
8
votes
2answers
299 views

How to portray to a user the security of an input field?

I was just tasked by my boss to make a certain SSN field to appear more secure. We currently are masking the first 5 numbers but he wants a greater feel of security behind the input. He was thinking ...
1
vote
3answers
363 views

What happens in a web browser when a download is started via Javascript?

In a web browser, a download can be initiated immediately after user input, or started via Javascript after a set amount of time and/or being redirected to another page. I want to provide users with ...
3
votes
2answers
360 views

secure banking apps

A while ago my bank introduced an online banking app. This allowed me to quickly access my bank account and make payments right from my phone with the best experience. In order to gain access to the ...
2
votes
4answers
225 views

How to increase trust and security feeling when collecting bank information

I have a site that needs to collect a user's bank username/password. This is obviously a big hurdle for someone to get over but we have to do that. I'm looking for ways, visually & textually, to ...