How an application is kept secure to prevent unauthorized access.

learn more… | top users | synonyms

6
votes
2answers
590 views

Should we require confirmation before resetting a password?

If a user has forgotten their password for a service, the convention is that they should need only their username and/or registered email address in order to reset their password -- in our case that ...
5
votes
4answers
284 views

Logging in with email only

I'm working on a blog and there will be an option to post a comment. I could implement registration with username, password and email — the standard way. I could implement 3rd-party authorization ...
5
votes
3answers
1k views

Norton Safe Web Verification — Impact on User

I have a client who insists on getting their website validated by Norton Security Verification and displaying the seal. However, I am skeptic and do not trust Norton products. I recall an impression ...
5
votes
3answers
645 views

Use UAC Shield icon to indicate (non-Windows) elevation will be required?

i am working on financial software where there are many times where a "supervisor" is required to authorize that the user can continue, e.g.: user wants to void a funds transfer user has a variance ...
5
votes
3answers
2k views

Input mask on credit card number & SSN

Our company is discussing the use of an input mask (asterisk) on credit card numbers and social security numbers. I'm completely against masking the CCN, from a UX perspective, especially since our ...
5
votes
2answers
215 views

How can I reassure users about an unfamiliar domain name?

I have a service, example-service.com. I have customers customer-a.com, customer-b.com, etc. We host a service for them on urls like customer-a.example-service.com Users who are familiar with ...
5
votes
2answers
274 views

Password and in place editing

I decided to support in place editing for a simple user table. I am not sure what i should do about password... When i create a new user i can have a textbox to type... When viewing i can hide then ...
5
votes
1answer
467 views

Usable examples, recommended practices for interfaces optimized for using pass-phrases instead of passwords

Reading through What is the best way to inspire users to choose strong password?, I realized I have never used an interface where the primary login password system would use pass-phrases (and where ...
5
votes
1answer
303 views

What is the benefit of fixed security questions?

Many sites/services seem to make use of a security question as a way of accessing an account if you lose your password or email access. As an example, Facebook uses this form: There isn't a ...
5
votes
2answers
119 views

Using color and graphics to improve visualhostkey, and make comparing SHA256 hashes easier

I need anonymous end users to visualize hashed data, be it a Bitcoin Address (converted to the Sha256 hash it's based upon) File hash SSH key Since my target audience is normal consumers, and not ...
5
votes
2answers
136 views

What are the conventions for how often a user should be asked to log into a mobile application?

Or put another way - is there a process for deciding how long a user's authenticated session should last?
5
votes
3answers
164 views

How to communicate that an app never sends information to a server?

If you have an app that never sends any information to any server, what would be the best way to communicate this via the UI? Background: I produce an app that stores data chosen by the user, ...
4
votes
4answers
76 views

How to emphasize that downloads may be a malicious to users?

These applications allow cyber security professionals to access files that are involved in reported malicious online incidents. This is the part of a larger service offering to these users. 99% of the ...
4
votes
5answers
293 views

Should editing a password be 2 step process or all in one form?

We have a web application whereby a user's profile screen uses a card-based layout. One of the cards allows users to update their password. Our team is split on how the password card should be laid ...
4
votes
2answers
349 views

How to handle creating new account with email address that is unverified on another account?

We have email address verification on our accounts. Users have to verify their email addresses when they create their accounts and when they update their email addresses on existing accounts. With new ...
4
votes
2answers
722 views

Force log out users on applying a password policy?

Consider this use-case for an enterprise social network. Users have already signed up but after some time, the admin for the network decides to apply a password policy. Does applying a password ...
4
votes
4answers
188 views

Security issues if not forcing a user to sign up

I've built a simple web app Flask.io that enables users to create and share to-do lists. It doesn't require sign up. This is an important differentiator. I don't want to force the user to register ...
4
votes
3answers
158 views

Email address entry field on public kiosk system

Interesting discussion internally at this end re a sign-up/login mechanic that will be running within a public kiosk/display application. The question we have is related to whether or not we should ...
4
votes
2answers
562 views

secure banking apps

A while ago my bank introduced an online banking app. This allowed me to quickly access my bank account and make payments right from my phone with the best experience. In order to gain access to the ...
4
votes
2answers
53 views

Best options for designing my own customised captcha-type process?

Okay, I've finally had enough of these stupid non-user-friendly Captcha images. Tonight I visited a site I had every intention of doing business with, but prior to being able to view the content (God ...
4
votes
2answers
130 views

Login mechanism for multiuser smart-phones/tablet

What should be the mechanism for login in a shared smartphone or tablet? Should it be username + password as it is in PCs or should be enough using a password / PIN? I'm interested on both security ...
4
votes
1answer
133 views

Encryption of chat messages and possibility of password loss

I have a client-server chat like app. I would like to add an encryption of messages for users. So, that they will be sure that no one, even service owner, can read their confidential information. I'm ...
4
votes
2answers
755 views

Forgot Password Alternatives?

Does anyone know of a good alternative to the Forgot Password link on login forms? I'm not looking to eliminate the link, but to provide an alternate method for retrieving lost passwords. Our current ...
4
votes
3answers
109 views

Correct UX for the scenario when a user forgets the answers to their security questions?

We have an application where a user is required upon registration to set up three security questions and answers When they login to the application, they must answer one of the questions after ...
4
votes
1answer
129 views

Is there any research into whether/how people save username/password combinations?

It's something of an open secret that many people don't handle the security of their accounts online in the same way the designers of such systems would want them to. This is why we often see text ...
4
votes
2answers
763 views

What is the recommended time before a reset password link expires?

I'm working on a financially leaning site and was curious — is there a standard amount of time to wait before expiring a reset password link once a user has forgotten his/hers and requested to reset ...
4
votes
1answer
105 views

Should link to restore user account lead him to login page?

Pinterest has a deactivate my account function. After user deactivates his account, he gets an email with Reactivate account link: Here Reactivate button links to login form with username and ...
3
votes
3answers
1k views

Which browsers allow users to reveal passwords in password fields?

Which browsers allow users to reveal passwords in password fields? I already know that Windows 8, Windows 8.1, Internet Explorer 10 and Internet Explorer 11 (1). Cursory research did not reveal any ...
3
votes
2answers
64 views

What do you do when the user interrupts the purchase process?

If a user on an e-commerce site is in the middle of a purchase process when they leave to another part of the site, or perhaps leave the site completely, what information should be retained if they ...
3
votes
3answers
332 views

Limiting access before email address is confirmed

I'm making a directory site and I'm considering having the following setup for email confirmation: After registering, user has x hours to confirm their email. They're sent immediately to the next ...
3
votes
3answers
200 views

Reset password, appropriate response if email doesn't exist?

It is common on login forms to see "Email or password is incorrect" when the user types in their account details incorrectly instead of just "password is incorrect". This is, for among other reasons, ...
3
votes
2answers
128 views

studies on passcode/keypad versus password/keyboard?

When designing a tablet-based app that needs it's own extra security, there seems to be a couple of common choices: add a password screen with a keyboard, or use a passcode screen that has a keypad. ...
3
votes
3answers
3k views

Case sensitive vs case insensitive passwords

My website has always used case insensitive passwords for millions of users. The security specialist is pushing us to change to case sensitive passwords. Are there any studies or best practices on ...
3
votes
3answers
169 views

Why warn about caps lock for passwords, instead of ignoring caps lock for password characters?

Many login screens warn the user if the caps lock key is switched on. Most prominently the windows login screen. Does this offer any advantage compared to simply ignoring the caps lock key and ...
3
votes
1answer
118 views

UX Measures to protect users from phishing sites

I the last days I was thinking about possible solutions to protect your users from putting their data into forms on phishing websites and how you could warn them or "educate" them into not doing that. ...
3
votes
2answers
123 views

Should a (permanent) password field show the correct amount of bullets of the entered password?

I'm working on an desktop program and noticed the following interface: Don't want to go into the details of the form, but basically, the user can enter an alternative username/password to login ...
3
votes
3answers
172 views

On login forms, should user's email be remembered?

I'm having this discussion with a customer of mine, he wants me to pre-populate the user's email address on the login form, to make it easier to login, he does not want me to add a checkbox to have ...
3
votes
1answer
169 views

Prompting customer login before making changes to their account

In a project I'm working on, there's a service website where customers can register objects they own in order to use the service. If a customer owns many of these objects, all can be registered on the ...
3
votes
4answers
529 views

Is there a better way rather than forcing a double sign-in? Inspired by Youtube commenting by Google plus

This is an awkward question, combined with a irritated observation. Please forgive the irritated tone. I am very frustrated by the repeated messages I get on YouTube if I want to do as little as ...
3
votes
1answer
178 views

Unlock Account for Highly Secure Website

I am working on project for a very secure sensitive website in which the objective is to make the "unlock account" workflow easy and intuitive. Currently, if user enters wrong username and password ...
3
votes
1answer
353 views

Are there specific standards, guidelines, and processes UX in security?

There are a number of resources with well-defined standards and practices for UX, and there are principles in security relevant to UX such as the principle of Psychological Acceptability. However, as ...
3
votes
2answers
107 views

Am I supposed to lose everything else in my life when I lose my phone number? [closed]

Sorry, this isn't a coding or design problem, but it is a user-experience issue, and I'm looking for some kind of a discussion about it, and this is the best place I can come up with to discuss. I ...
3
votes
0answers
74 views

How should I allow Facebook-linked accounts to post anonymously? [closed]

I'm building a WordPress-based website where users will create an account from their Facebook account. Users will be able to post and comment but I'd like to offer the option for anonymous ...
2
votes
3answers
761 views

Should users see a 404 page if they are trying to view locked content?

If a user attempts to view a private repo on GitHub when they are not logged in, they get a 404 error page. Pro) It seems that the repo does not exist to those lacking proper access. This might help ...
2
votes
5answers
761 views

Limiting customer credit cards to a single account

Is it a good idea to limit a customer's credit card so that it can only be used on one user account? The user can have as many credit cards associated with their account as they like, but they cannot ...
2
votes
5answers
251 views

What kind of user interface design practices can protect the information from someone who might be peeking at user's screen

What kind of UI design practices one could employ to protect the user's sensitive information from someone who might be looking (occasionally) at user's monitor from behind a shoulder or a nearby ...
2
votes
2answers
163 views

Why is it that almost all anti-virus software has custom built skins?

I am yet to see an anti-virus software that's using the native Windows theme. Why do they prefer custom skins over native windows skins? Does it have anything to do with security and/or consistency? ...
2
votes
3answers
1k views

How to make a user feel secure when using an iframe for payments

I've got a site where it's very difficult for me to add SSL, so I'm using a secure iframe on the payment page to collect credit card details. Currently it's set up to appear like it's the same site. ...
2
votes
1answer
292 views

Why do some people physically cover their macbook cameras [closed]

Obviously, if a malicious user could save camera snapshots or streams you have a bigger issue on your hands than improperly lighted selfies. Or do they simply not get this / this isn't as commonly ...
2
votes
1answer
1k views

What's the advantage of disabling paste functionality for password input field? [duplicate]

Some web forms don't let the user paste text into password input fields. For example I just noticed this on Apple's iTunes Connect website: https://itunesconnect.apple.com/ I don't see any ...