How an application is kept secure to prevent unauthorized access.

learn more… | top users | synonyms

5
votes
2answers
115 views

What are the conventions for how often a user should be asked to log into a mobile application?

Or put another way - is there a process for deciding how long a user's authenticated session should last?
4
votes
3answers
770 views

Norton Safe Web Verification — Impact on User

I have a client who insists on getting their website validated by Norton Security Verification and displaying the seal. However, I am skeptic and do not trust Norton products. I recall an impression ...
4
votes
4answers
156 views

Security issues if not forcing a user to sign up

I've built a simple web app Flask.io that enables users to create and share to-do lists. It doesn't require sign up. This is an important differentiator. I don't want to force the user to register ...
4
votes
3answers
128 views

Email address entry field on public kiosk system

Interesting discussion internally at this end re a sign-up/login mechanic that will be running within a public kiosk/display application. The question we have is related to whether or not we should ...
4
votes
1answer
115 views

Encryption of chat messages and possibility of password loss

I have a client-server chat like app. I would like to add an encryption of messages for users. So, that they will be sure that no one, even service owner, can read their confidential information. I'm ...
4
votes
2answers
480 views

Forgot Password Alternatives?

Does anyone know of a good alternative to the Forgot Password link on login forms? I'm not looking to eliminate the link, but to provide an alternate method for retrieving lost passwords. Our current ...
4
votes
1answer
87 views

Should link to restore user account lead him to login page?

Pinterest has a deactivate my account function. After user deactivates his account, he gets an email with Reactivate account link: Here Reactivate button links to login form with username and ...
3
votes
2answers
234 views

How to handle creating new account with email address that is unverified on another account?

We have email address verification on our accounts. Users have to verify their email addresses when they create their accounts and when they update their email addresses on existing accounts. With new ...
3
votes
2answers
278 views

secure banking apps

A while ago my bank introduced an online banking app. This allowed me to quickly access my bank account and make payments right from my phone with the best experience. In order to gain access to the ...
3
votes
2answers
100 views

studies on passcode/keypad versus password/keyboard?

When designing a tablet-based app that needs it's own extra security, there seems to be a couple of common choices: add a password screen with a keyboard, or use a passcode screen that has a keypad. ...
3
votes
3answers
1k views

Case sensitive vs case insensitive passwords

My website has always used case insensitive passwords for millions of users. The security specialist is pushing us to change to case sensitive passwords. Are there any studies or best practices on ...
3
votes
2answers
117 views

Login mechanism for multiuser smart-phones/tablet

What should be the mechanism for login in a shared smartphone or tablet? Should it be username + password as it is in PCs or should be enough using a password / PIN? I'm interested on both security ...
3
votes
3answers
141 views

On login forms, should user's email be remembered?

I'm having this discussion with a customer of mine, he wants me to pre-populate the user's email address on the login form, to make it easier to login, he does not want me to add a checkbox to have ...
3
votes
4answers
443 views

Is there a better way rather than forcing a double sign-in? Inspired by Youtube commenting by Google plus

This is an awkward question, combined with a irritated observation. Please forgive the irritated tone. I am very frustrated by the repeated messages I get on YouTube if I want to do as little as ...
3
votes
2answers
189 views

What is the recommended time before a reset password link expires?

I'm working on a financially leaning site and was curious — is there a standard amount of time to wait before expiring a reset password link once a user has forgotten his/hers and requested to reset ...
3
votes
1answer
135 views

Unlock Account for Highly Secure Website

I am working on project for a very secure sensitive website in which the objective is to make the "unlock account" workflow easy and intuitive. Currently, if user enters wrong username and password ...
3
votes
1answer
173 views

Are there specific standards, guidelines, and processes UX in security?

There are a number of resources with well-defined standards and practices for UX, and there are principles in security relevant to UX such as the principle of Psychological Acceptability. However, as ...
2
votes
5answers
592 views

Limiting customer credit cards to a single account

Is it a good idea to limit a customer's credit card so that it can only be used on one user account? The user can have as many credit cards associated with their account as they like, but they cannot ...
2
votes
5answers
221 views

What kind of user interface design practices can protect the information from someone who might be peeking at user's screen

What kind of UI design practices one could employ to protect the user's sensitive information from someone who might be looking (occasionally) at user's monitor from behind a shoulder or a nearby ...
2
votes
3answers
724 views

How to make a user feel secure when using an iframe for payments

I've got a site where it's very difficult for me to add SSL, so I'm using a secure iframe on the payment page to collect credit card details. Currently it's set up to appear like it's the same site. ...
2
votes
3answers
252 views

Which browsers allow users to reveal passwords in password fields?

Which browsers allow users to reveal passwords in password fields? I already know that Windows 8, Windows 8.1, Internet Explorer 10 and Internet Explorer 11 (1). Cursory research did not reveal any ...
2
votes
1answer
586 views

What's the advantage of disabling paste functionality for password input field? [duplicate]

Some web forms don't let the user paste text into password input fields. For example I just noticed this on Apple's iTunes Connect website: https://itunesconnect.apple.com/ I don't see any ...
2
votes
3answers
232 views

Limiting access before email address is confirmed

I'm making a directory site and I'm considering having the following setup for email confirmation: After registering, user has x hours to confirm their email. They're sent immediately to the next ...
2
votes
4answers
117 views

How to best inform user they cant use the service for a period of time after registering?

For security reasons, after registering we cant let the user actually use the product until 14 days have past. Right now I'm just appending a message at the end of the form (Ann#3) - is there a ...
2
votes
4answers
166 views

How to increase trust and security feeling when collecting bank information

I have a site that needs to collect a user's bank username/password. This is obviously a big hurdle for someone to get over but we have to do that. I'm looking for ways, visually & textually, to ...
2
votes
4answers
112 views

Should you be allowed to change your own data?

Let's imagine you were about to use a CRM Enterprise-Application that contains your working-data (street, housenumber, office phone number and so on). Should we allow the user to change this data at ...
2
votes
1answer
85 views

Can providing articles on security improve the perception users have of the security of a website?

I also know many who turns off scripting (JavaScript) from running on their system and won't open any website without HTTPS or any security protocol. Whenever I read about Facebook updating its ...
2
votes
1answer
205 views

Implementing account lock out on a website

A web vulnerability scanner on my website made a suggestion that I implement an account lockout mechanism for my site when there has been a certain number of invalid login attempts. I am trying to ...
2
votes
1answer
264 views

May Facebook and Google+ login make a site feel 'insecure'?

Lets say I have a website which handles your money in some way. So I know about your credit cards. Currently, user register using their national identification number. So all the users are real ...
2
votes
1answer
63 views

Prompting customer login before making changes to their account

In a project I'm working on, there's a service website where customers can register objects they own in order to use the service. If a customer owns many of these objects, all can be registered on the ...
2
votes
0answers
253 views

How to provide good mobile phone number verification? [closed]

I'd like to know if there is a way to achieve a good user experience when a user's profile contains a mobile number which needs to be verified via SMS. The examples I have explored had the mobile ...
1
vote
3answers
169 views

Should users see a 404 page if they are trying to view locked content?

If a user attempts to view a private repo on GitHub when they are not logged in, they get a 404 error page. Pro) It seems that the repo does not exist to those lacking proper access. This might help ...
1
vote
3answers
129 views

show ip history to login user

Show ip history, like last 100 logins IP and time, can be scare user? I think maybe user think why service provider store my IP? of course after some storing we can have fraud detection my solution ...
1
vote
1answer
144 views

Why do some people physically cover their macbook cameras [closed]

Obviously, if a malicious user could save camera snapshots or streams you have a bigger issue on your hands than improperly lighted selfies. Or do they simply not get this / this isn't as commonly ...
1
vote
2answers
108 views

UX failure in Apple's security update process

It would have been much better if I could download the 700+ MB download in the background while continuing to work and THEN pull the trigger on applying the patch. There are no real reasons to couple ...
1
vote
1answer
63 views

Can you use similar security questions used on email registration for a more corporate tool?

I am developing a set of security questions for a corporate website. The usual security questions I come across are mothers birthplace, best childhood friend, ect. These questions don't seem fitting ...
1
vote
2answers
170 views

Should I show a customer granular credit card errors?

When credit cards are declined, our gateway usually provides a useful reason: insufficient funds, CVV mismatch, invalid card number, etc. Should we show this to the user? Or should we just show a ...
1
vote
1answer
721 views

Prevent Active Directory password expiration when user never logs in

Let's assume the following in a hospital: Each nurse has her own Active Directory user, with a password. The password expires automatically 90 days after the password was set. A nurse uses her own ...
1
vote
2answers
182 views

How does the perception of website data being insecure affect usability?

If the user perceives that data entered into a website is insecure (if it is perceived that it can be hacked, stolen or tampered with), how is the usability of the site affected? This question is in ...
1
vote
1answer
52 views

Best practice for two-step verification process

Perhaps due to the recent incidents behind hacking of user database and identity theft, many organizations have introduced the two-step verification process, in particular when users are accessing the ...
1
vote
2answers
164 views

Why do some cars only have a physical lock on the driver side?

I have a car (tsx) and I realize that sometimes I will need to use the physical key instead of the electronic key fob to unlock my car. Such as if there is something wrong with the electronics or my ...
1
vote
3answers
346 views

What happens in a web browser when a download is started via Javascript?

In a web browser, a download can be initiated immediately after user input, or started via Javascript after a set amount of time and/or being redirected to another page. I want to provide users with ...
1
vote
1answer
85 views

Installing recording software

On an upcoming visit to a user's place of work, I would like to have them install Morae Recorder beforehand. This is likely to be a problem for the user's IT Security people. In the past, especially ...
1
vote
1answer
115 views

Is there an established way of representing Single Sign On with an icon? [closed]

I'm wracking my brains trying to think of representing Single Sign On iconographically. Is there a common way this is done?
0
votes
3answers
285 views

Should a web browser indicate “year” near the lock icon to encourage more safe/secure website?

There are many important technologies coming to web browsers in the next few years. Not to mention that where we are today is a culmination of lessons learned and several security pitfalls. However, ...
0
votes
1answer
67 views

Optional password field on login

We want all users to enter their employment ID so we can identify them, but it's not so important that we require them to register or remember a password. Some users will be registered for the ...
0
votes
2answers
471 views

Usability vs. Security [closed]

This question has started to preoccupy since read Stevey's Google Platforms Rant by Steve Yegge. (The original post was removed.) Among many other things he asserts that usability is more important ...
0
votes
1answer
59 views

What makes a download link in email feel legit?

I'm creating a web app where users can provide snapshots of the page they are viewing and share them via email in a downloadable format. What are best practices for creating a sense of security for ...
0
votes
1answer
63 views

What's the best type of car key? [closed]

Everyone is familiar with the regular physical key and lock for their car. But nowadays, new cars have all kinds of fancy key fob systems to lock and unlock their car. But what is the best in terms ...
0
votes
3answers
61 views

Contact us link: should a user be forced to log in right away?

Let's pretend we're a university optometry department and the tech support/contact us link on our website can be accessed by optometrists, their staff members, and patients alike. A patient is ...