How an application is kept secure to prevent unauthorized access.

learn more… | top users | synonyms

15
votes
4answers
1k views

What good is this moving captcha from Apple

A Hacker News article pointed me to http://www.apple.com/itunes/50-billion-app-countdown/entry-form/ where they use moving captchas: I assume that its a way to make shorter (and therefore ...
4
votes
4answers
156 views

Security issues if not forcing a user to sign up

I've built a simple web app Flask.io that enables users to create and share to-do lists. It doesn't require sign up. This is an important differentiator. I don't want to force the user to register ...
4
votes
3answers
755 views

Norton Safe Web Verification — Impact on User

I have a client who insists on getting their website validated by Norton Security Verification and displaying the seal. However, I am skeptic and do not trust Norton products. I recall an impression ...
3
votes
2answers
234 views

How to handle creating new account with email address that is unverified on another account?

We have email address verification on our accounts. Users have to verify their email addresses when they create their accounts and when they update their email addresses on existing accounts. With new ...
5
votes
2answers
236 views

Password and in place editing

I decided to support in place editing for a simple user table. I am not sure what i should do about password... When i create a new user i can have a textbox to type... When viewing i can hide then ...
6
votes
3answers
1k views

Should we ask for name on card even though it's not required for credit card payments?

The name on card is not used when processing credit card payments. Paypal does not ask the user to enter the name on card when saving a card to the "wallet", while Amazon.com does. The benefit of ...
3
votes
2answers
99 views

studies on passcode/keypad versus password/keyboard?

When designing a tablet-based app that needs it's own extra security, there seems to be a couple of common choices: add a password screen with a keyboard, or use a passcode screen that has a keypad. ...
5
votes
3answers
192 views

Logging in with email only

I'm working on a blog and there will be an option to post a comment. I could implement registration with username, password and email — the standard way. I could implement 3rd-party authorization ...
10
votes
2answers
233 views

Why would one limit username format?

Many websites when ask you to create a new "username", will limit you in some way, most often like "username should only contain letters and underscores" or something alike. This results in inability ...
5
votes
5answers
754 views

Forgotten Passwords - is there a real benefit to asking for memorable password hints on signup?

On several signup forms I see fields such as "Choose your Memorable Password Question". Is this actually benifical nowadays? Surely a more secure method if someone forgets their password is to build a ...
23
votes
6answers
1k views

Forcing users to use a particular pattern for passwords

Many websites, specially government ones, enforce users to use a password which conforms to particular criteria. For example: use between 8-13 characters with at-least one integer and one capital ...
43
votes
17answers
6k views

Computer login with password only, without username

I have an idea to simplify the login screen on things like home computers with a small number of users (say, 2-10) with passwords. Today, a typical home computer's login screen has three steps: ...
1
vote
1answer
85 views

Installing recording software

On an upcoming visit to a user's place of work, I would like to have them install Morae Recorder beforehand. This is likely to be a problem for the user's IT Security people. In the past, especially ...
2
votes
3answers
715 views

How to make a user feel secure when using an iframe for payments

I've got a site where it's very difficult for me to add SSL, so I'm using a secure iframe on the payment page to collect credit card details. Currently it's set up to appear like it's the same site. ...
2
votes
5answers
586 views

Limiting customer credit cards to a single account

Is it a good idea to limit a customer's credit card so that it can only be used on one user account? The user can have as many credit cards associated with their account as they like, but they cannot ...
4
votes
1answer
87 views

Should link to restore user account lead him to login page?

Pinterest has a deactivate my account function. After user deactivates his account, he gets an email with Reactivate account link: Here Reactivate button links to login form with username and ...
6
votes
3answers
225 views

Should an admin decide what users can do, or should he decide what not to do?

Which one is better option for an admin from a usability point of view? Suppose if a system is supposed to authorize a user to have access (and different type of access like read only or read write) ...
5
votes
3answers
700 views

Input mask on credit card number & SSN

Our company is discussing the use of an input mask (asterisk) on credit card numbers and social security numbers. I'm completely against masking the CCN, from a UX perspective, especially since our ...
7
votes
2answers
283 views

Does inline validation at login create a security risk or a perception of one?

When a user types their email address into a login form, I'd like to validate inline whether the email is associated with an account. The idea here is that, in the system in question, a large ...
2
votes
4answers
112 views

Should you be allowed to change your own data?

Let's imagine you were about to use a CRM Enterprise-Application that contains your working-data (street, housenumber, office phone number and so on). Should we allow the user to change this data at ...
1
vote
2answers
181 views

How does the perception of website data being insecure affect usability?

If the user perceives that data entered into a website is insecure (if it is perceived that it can be hacked, stolen or tampered with), how is the usability of the site affected? This question is in ...
2
votes
1answer
85 views

Can providing articles on security improve the perception users have of the security of a website?

I also know many who turns off scripting (JavaScript) from running on their system and won't open any website without HTTPS or any security protocol. Whenever I read about Facebook updating its ...
3
votes
2answers
116 views

Login mechanism for multiuser smart-phones/tablet

What should be the mechanism for login in a shared smartphone or tablet? Should it be username + password as it is in PCs or should be enough using a password / PIN? I'm interested on both security ...
0
votes
1answer
78 views

Any good examples of a user signing up for a Browser Certificate / Client Certificate?

A client certificate is something that is used with TLS/SSL to increase security of the HTTPS session. There are two parts to this The user needs to create the certificate, have it approved (which ...
8
votes
6answers
1k views

How to handle “forgot password” when user has not confirmed email?

If you follow the pattern of allowing users access to your application without having confirmed an email (generally considered good UX), how do handle the case where they forgot their password? Very ...
2
votes
3answers
230 views

Limiting access before email address is confirmed

I'm making a directory site and I'm considering having the following setup for email confirmation: After registering, user has x hours to confirm their email. They're sent immediately to the next ...
1
vote
1answer
63 views

Can you use similar security questions used on email registration for a more corporate tool?

I am developing a set of security questions for a corporate website. The usual security questions I come across are mothers birthplace, best childhood friend, ect. These questions don't seem fitting ...
9
votes
1answer
510 views

Why does MediaWiki put little padlocks on HTTPS links?

Does anyone know why MediaWiki puts little padlock icons next to HTTPS links? For example, if I put this link in a wiki article: https://twitter.com/harry_wood it would get a little yellow padlock by ...
2
votes
0answers
252 views

How to provide good mobile phone number verification? [closed]

I'd like to know if there is a way to achieve a good user experience when a user's profile contains a mobile number which needs to be verified via SMS. The examples I have explored had the mobile ...
3
votes
3answers
1k views

Case sensitive vs case insensitive passwords

My website has always used case insensitive passwords for millions of users. The security specialist is pushing us to change to case sensitive passwords. Are there any studies or best practices on ...
15
votes
5answers
1k views

Should I use two steps or one when users change password?

I currently have a page dedicated to changing passwords. There are 2 options: A 2 step option: download bmml source – Wireframes created with Balsamiq Mockups download bmml ...
5
votes
2answers
115 views

What are the conventions for how often a user should be asked to log into a mobile application?

Or put another way - is there a process for deciding how long a user's authenticated session should last?
4
votes
1answer
114 views

Encryption of chat messages and possibility of password loss

I have a client-server chat like app. I would like to add an encryption of messages for users. So, that they will be sure that no one, even service owner, can read their confidential information. I'm ...
3
votes
1answer
171 views

Are there specific standards, guidelines, and processes UX in security?

There are a number of resources with well-defined standards and practices for UX, and there are principles in security relevant to UX such as the principle of Psychological Acceptability. However, as ...
4
votes
2answers
472 views

Forgot Password Alternatives?

Does anyone know of a good alternative to the Forgot Password link on login forms? I'm not looking to eliminate the link, but to provide an alternate method for retrieving lost passwords. Our current ...
6
votes
2answers
427 views

Should we require confirmation before resetting a password?

If a user has forgotten their password for a service, the convention is that they should need only their username and/or registered email address in order to reset their password -- in our case that ...
11
votes
4answers
500 views

When is it right to use “Not <user>?”

Sometimes a site shows a message reading: "You are logged in as [user1]. Not [user1]? Please log out." When is it right to use such a thing? Where are we assuming someone is mistakenly logged in as ...
5
votes
2answers
204 views

How can I reassure users about an unfamiliar domain name?

I have a service, example-service.com. I have customers customer-a.com, customer-b.com, etc. We host a service for them on urls like customer-a.example-service.com Users who are familiar with ...
9
votes
3answers
781 views

Why did they use two-stage social media sharing buttons?

I recently visited a seemingly fairly reputable web site and was astonished to see their implementation of a two-stage trigger for their social media buttons: (The text appears when you hover over ...
50
votes
10answers
5k views

Refusing a user permission to click a URL

I've been asked to work on a system message on an intranet where by there are various URLs (linking to lists of content) that have permission rights attached to them, so only certain users have access ...
5
votes
1answer
326 views

Usable examples, recommended practices for interfaces optimized for using pass-phrases instead of passwords

Reading through What is the best way to inspire users to choose strong password?, I realized I have never used an interface where the primary login password system would use pass-phrases (and where ...
8
votes
1answer
251 views

During sign ups, how to best instill confidence that email addresses will be safe

Many sign up forms will ask you for an email address so that they can contact you. Even the most minimal sign-up (other than no sign up) will need an email address to send you a validation email. ...
17
votes
6answers
741 views

Should validating an email automatically sign someone into an application?

When signing up for a new account with a web application, it is standard to send a validation email. I don't want to go into the pros and cons of the validation email though. When receiving a ...
1
vote
1answer
115 views

Is there an established way of representing Single Sign On with an icon? [closed]

I'm wracking my brains trying to think of representing Single Sign On iconographically. Is there a common way this is done?
0
votes
2answers
469 views

Usability vs. Security [closed]

This question has started to preoccupy since read Stevey's Google Platforms Rant by Steve Yegge. (The original post was removed.) Among many other things he asserts that usability is more important ...
0
votes
2answers
120 views

User testing browser add-on

I'm working on a browser add-on that has some novel usability ideas, and I'd like to test them out on some users. The add-on interacts with the user's password data and usage, and I'd like to collect ...
5
votes
1answer
228 views

What is the benefit of fixed security questions?

Many sites/services seem to make use of a security question as a way of accessing an account if you lose your password or email access. As an example, Facebook uses this form: There isn't a ...
7
votes
3answers
461 views

Has Captcha become common knowledge?

I am doing a business site for a web company, and was wondering if Captcha has become so well-known, that it no longer needs an explanation ? Right now there is only a input box, the captcha image ...
0
votes
3answers
284 views

Should a web browser indicate “year” near the lock icon to encourage more safe/secure website?

There are many important technologies coming to web browsers in the next few years. Not to mention that where we are today is a culmination of lessons learned and several security pitfalls. However, ...
5
votes
3answers
477 views

Use UAC Shield icon to indicate (non-Windows) elevation will be required?

i am working on financial software where there are many times where a "supervisor" is required to authorize that the user can continue, e.g.: user wants to void a funds transfer user has a variance ...