0
votes
1answer
56 views

What makes a download link in email feel legit?

I'm creating a web app where users can provide snapshots of the page they are viewing and share them via email in a downloadable format. What are best practices for creating a sense of security for ...
9
votes
4answers
204 views

Secure but still usable license key retrieval mechanism?

I just had a very interesting conversation with a support rep of a software product that I love (and which shall remain anonymous here). They use product keys for licensing, and in case the user ...
4
votes
3answers
123 views

Email address entry field on public kiosk system

Interesting discussion internally at this end re a sign-up/login mechanic that will be running within a public kiosk/display application. The question we have is related to whether or not we should ...
5
votes
3answers
190 views

Logging in with email only

I'm working on a blog and there will be an option to post a comment. I could implement registration with username, password and email — the standard way. I could implement 3rd-party authorization ...
2
votes
3answers
229 views

Limiting access before email address is confirmed

I'm making a directory site and I'm considering having the following setup for email confirmation: After registering, user has x hours to confirm their email. They're sent immediately to the next ...
7
votes
1answer
245 views

During sign ups, how to best instill confidence that email addresses will be safe

Many sign up forms will ask you for an email address so that they can contact you. Even the most minimal sign-up (other than no sign up) will need an email address to send you a validation email. ...
17
votes
6answers
714 views

Should validating an email automatically sign someone into an application?

When signing up for a new account with a web application, it is standard to send a validation email. I don't want to go into the pros and cons of the validation email though. When receiving a ...
3
votes
2answers
232 views

How to handle creating new account with email address that is unverified on another account?

We have email address verification on our accounts. Users have to verify their email addresses when they create their accounts and when they update their email addresses on existing accounts. With new ...