11
votes
3answers
1k views

Should I capture exceptions and present a nice error page to hackers? [closed]

If a hacker is trying to hack, should I present a pretty error page or redirect somewhere instead of a generic/cryptic error? I feel that the hacker knows what they are doing, I know what they are ...
8
votes
4answers
372 views

Should “Incorrect password” message show the password requirements of the current site? [duplicate]

I have a question that has been bothering me some time, let me illustrate my question with an example: I use multiple passwords in many applications and sometimes I forget what is the password for ...
7
votes
2answers
272 views

How to portray to a user the security of an input field?

I was just tasked by my boss to make a certain SSN field to appear more secure. We currently are masking the first 5 numbers but he wants a greater feel of security behind the input. He was thinking ...
1
vote
3answers
346 views

What happens in a web browser when a download is started via Javascript?

In a web browser, a download can be initiated immediately after user input, or started via Javascript after a set amount of time and/or being redirected to another page. I want to provide users with ...
6
votes
3answers
843 views

Login for multiple users

What is the best way to make a login form for multiple users? I'll give you an example for your understanding: If we have three different type of users, for example, teachers, students and ...
5
votes
3answers
709 views

Input mask on credit card number & SSN

Our company is discussing the use of an input mask (asterisk) on credit card numbers and social security numbers. I'm completely against masking the CCN, from a UX perspective, especially since our ...
4
votes
1answer
115 views

Encryption of chat messages and possibility of password loss

I have a client-server chat like app. I would like to add an encryption of messages for users. So, that they will be sure that no one, even service owner, can read their confidential information. I'm ...
8
votes
1answer
251 views

During sign ups, how to best instill confidence that email addresses will be safe

Many sign up forms will ask you for an email address so that they can contact you. Even the most minimal sign-up (other than no sign up) will need an email address to send you a validation email. ...
10
votes
5answers
647 views

Does SSL on a company's website make the company appear more credible?

I recently had a thought about the way many modern browsers display information about a site's security certificates. At least Firefox shows a very noticeable blue box in the address bar on sites that ...
0
votes
3answers
285 views

Should a web browser indicate “year” near the lock icon to encourage more safe/secure website?

There are many important technologies coming to web browsers in the next few years. Not to mention that where we are today is a culmination of lessons learned and several security pitfalls. However, ...
8
votes
3answers
750 views

Usability and security for user access and password handling in a web application?

I'm looking at putting together a website aimed at ordinary users that will handle personal data which I don't want to be compromised. How can I make the site secure but also usable? It seems most ...