How an application is kept secure to prevent unauthorized access.

learn more… | top users | synonyms

5
votes
3answers
1k views

Input mask on credit card number & SSN

Our company is discussing the use of an input mask (asterisk) on credit card numbers and social security numbers. I'm completely against masking the CCN, from a UX perspective, especially since our ...
5
votes
2answers
210 views

How can I reassure users about an unfamiliar domain name?

I have a service, example-service.com. I have customers customer-a.com, customer-b.com, etc. We host a service for them on urls like customer-a.example-service.com Users who are familiar with ...
5
votes
2answers
260 views

Password and in place editing

I decided to support in place editing for a simple user table. I am not sure what i should do about password... When i create a new user i can have a textbox to type... When viewing i can hide then ...
5
votes
1answer
424 views

Usable examples, recommended practices for interfaces optimized for using pass-phrases instead of passwords

Reading through What is the best way to inspire users to choose strong password?, I realized I have never used an interface where the primary login password system would use pass-phrases (and where ...
5
votes
1answer
280 views

What is the benefit of fixed security questions?

Many sites/services seem to make use of a security question as a way of accessing an account if you lose your password or email access. As an example, Facebook uses this form: There isn't a ...
5
votes
2answers
125 views

What are the conventions for how often a user should be asked to log into a mobile application?

Or put another way - is there a process for deciding how long a user's authenticated session should last?
5
votes
2answers
101 views

Using color and graphics to improve visualhostkey, and make comparing SHA256 hashes easier

I need anonymous end users to visualize hashed data, be it a Bitcoin Address (converted to the Sha256 hash it's based upon) File hash SSH key Since my target audience is normal consumers, and not ...
4
votes
3answers
1k views

Norton Safe Web Verification — Impact on User

I have a client who insists on getting their website validated by Norton Security Verification and displaying the seal. However, I am skeptic and do not trust Norton products. I recall an impression ...
4
votes
5answers
221 views

Should editing a password be 2 step process or all in one form?

We have a web application whereby a user's profile screen uses a card-based layout. One of the cards allows users to update their password. Our team is split on how the password card should be laid ...
4
votes
4answers
180 views

Security issues if not forcing a user to sign up

I've built a simple web app Flask.io that enables users to create and share to-do lists. It doesn't require sign up. This is an important differentiator. I don't want to force the user to register ...
4
votes
2answers
395 views

secure banking apps

A while ago my bank introduced an online banking app. This allowed me to quickly access my bank account and make payments right from my phone with the best experience. In order to gain access to the ...
4
votes
3answers
146 views

Email address entry field on public kiosk system

Interesting discussion internally at this end re a sign-up/login mechanic that will be running within a public kiosk/display application. The question we have is related to whether or not we should ...
4
votes
2answers
128 views

Login mechanism for multiuser smart-phones/tablet

What should be the mechanism for login in a shared smartphone or tablet? Should it be username + password as it is in PCs or should be enough using a password / PIN? I'm interested on both security ...
4
votes
1answer
125 views

Encryption of chat messages and possibility of password loss

I have a client-server chat like app. I would like to add an encryption of messages for users. So, that they will be sure that no one, even service owner, can read their confidential information. I'm ...
4
votes
2answers
619 views

Forgot Password Alternatives?

Does anyone know of a good alternative to the Forgot Password link on login forms? I'm not looking to eliminate the link, but to provide an alternate method for retrieving lost passwords. Our current ...
4
votes
1answer
90 views

Is there any research into whether/how people save username/password combinations?

It's something of an open secret that many people don't handle the security of their accounts online in the same way the designers of such systems would want them to. This is why we often see text ...
4
votes
2answers
377 views

What is the recommended time before a reset password link expires?

I'm working on a financially leaning site and was curious — is there a standard amount of time to wait before expiring a reset password link once a user has forgotten his/hers and requested to reset ...
4
votes
1answer
98 views

Should link to restore user account lead him to login page?

Pinterest has a deactivate my account function. After user deactivates his account, he gets an email with Reactivate account link: Here Reactivate button links to login form with username and ...
3
votes
3answers
642 views

Which browsers allow users to reveal passwords in password fields?

Which browsers allow users to reveal passwords in password fields? I already know that Windows 8, Windows 8.1, Internet Explorer 10 and Internet Explorer 11 (1). Cursory research did not reveal any ...
3
votes
2answers
284 views

How to handle creating new account with email address that is unverified on another account?

We have email address verification on our accounts. Users have to verify their email addresses when they create their accounts and when they update their email addresses on existing accounts. With new ...
3
votes
2answers
53 views

What do you do when the user interrupts the purchase process?

If a user on an e-commerce site is in the middle of a purchase process when they leave to another part of the site, or perhaps leave the site completely, what information should be retained if they ...
3
votes
3answers
276 views

Limiting access before email address is confirmed

I'm making a directory site and I'm considering having the following setup for email confirmation: After registering, user has x hours to confirm their email. They're sent immediately to the next ...
3
votes
2answers
115 views

studies on passcode/keypad versus password/keyboard?

When designing a tablet-based app that needs it's own extra security, there seems to be a couple of common choices: add a password screen with a keyboard, or use a passcode screen that has a keypad. ...
3
votes
3answers
2k views

Case sensitive vs case insensitive passwords

My website has always used case insensitive passwords for millions of users. The security specialist is pushing us to change to case sensitive passwords. Are there any studies or best practices on ...
3
votes
3answers
161 views

On login forms, should user's email be remembered?

I'm having this discussion with a customer of mine, he wants me to pre-populate the user's email address on the login form, to make it easier to login, he does not want me to add a checkbox to have ...
3
votes
4answers
514 views

Is there a better way rather than forcing a double sign-in? Inspired by Youtube commenting by Google plus

This is an awkward question, combined with a irritated observation. Please forgive the irritated tone. I am very frustrated by the repeated messages I get on YouTube if I want to do as little as ...
3
votes
1answer
156 views

Unlock Account for Highly Secure Website

I am working on project for a very secure sensitive website in which the objective is to make the "unlock account" workflow easy and intuitive. Currently, if user enters wrong username and password ...
3
votes
1answer
266 views

Are there specific standards, guidelines, and processes UX in security?

There are a number of resources with well-defined standards and practices for UX, and there are principles in security relevant to UX such as the principle of Psychological Acceptability. However, as ...
3
votes
2answers
86 views

Should a (permanent) password field show the correct amount of bullets of the entered password?

I'm working on an desktop program and noticed the following interface: Don't want to go into the details of the form, but basically, the user can enter an alternative username/password to login ...
2
votes
3answers
478 views

Should users see a 404 page if they are trying to view locked content?

If a user attempts to view a private repo on GitHub when they are not logged in, they get a 404 error page. Pro) It seems that the repo does not exist to those lacking proper access. This might help ...
2
votes
5answers
691 views

Limiting customer credit cards to a single account

Is it a good idea to limit a customer's credit card so that it can only be used on one user account? The user can have as many credit cards associated with their account as they like, but they cannot ...
2
votes
5answers
237 views

What kind of user interface design practices can protect the information from someone who might be peeking at user's screen

What kind of UI design practices one could employ to protect the user's sensitive information from someone who might be looking (occasionally) at user's monitor from behind a shoulder or a nearby ...
2
votes
3answers
1k views

How to make a user feel secure when using an iframe for payments

I've got a site where it's very difficult for me to add SSL, so I'm using a secure iframe on the payment page to collect credit card details. Currently it's set up to appear like it's the same site. ...
2
votes
1answer
276 views

Why do some people physically cover their macbook cameras [closed]

Obviously, if a malicious user could save camera snapshots or streams you have a bigger issue on your hands than improperly lighted selfies. Or do they simply not get this / this isn't as commonly ...
2
votes
1answer
908 views

What's the advantage of disabling paste functionality for password input field? [duplicate]

Some web forms don't let the user paste text into password input fields. For example I just noticed this on Apple's iTunes Connect website: https://itunesconnect.apple.com/ I don't see any ...
2
votes
4answers
121 views

How to best inform user they cant use the service for a period of time after registering?

For security reasons, after registering we cant let the user actually use the product until 14 days have past. Right now I'm just appending a message at the end of the form (Ann#3) - is there a ...
2
votes
1answer
44 views

In Single Sign On what does SAML “enabled” control do or mean?

I am currently working on the redesign of SSO signup process/form and want to understand what enabling SAML control implies. The rationale being that if an organisation does not have SSO enabled the ...
2
votes
1answer
63 views

Should Operating Systems Hide Sizes of Files/Folders the User is Denied Access to?

If there are files or folders the current user should be denied access to, should their sizes be displayed when the user asks, for example with the ls -l command on Linux or the places the Windows ...
2
votes
4answers
257 views

How to increase trust and security feeling when collecting bank information

I have a site that needs to collect a user's bank username/password. This is obviously a big hurdle for someone to get over but we have to do that. I'm looking for ways, visually & textually, to ...
2
votes
4answers
116 views

Should you be allowed to change your own data?

Let's imagine you were about to use a CRM Enterprise-Application that contains your working-data (street, housenumber, office phone number and so on). Should we allow the user to change this data at ...
2
votes
1answer
87 views

Can providing articles on security improve the perception users have of the security of a website?

I also know many who turns off scripting (JavaScript) from running on their system and won't open any website without HTTPS or any security protocol. Whenever I read about Facebook updating its ...
2
votes
1answer
96 views

Automatic login on password reset

This question has been raised on http://security.stackexchange.com/questions/40723/why-do-you-need-to-login-after-you-change-a-password - With security in mind As one user states: "From a security ...
2
votes
1answer
41 views

Is there a standard for informing users about SSL/HTTPS on Android/iOS?

On a standard web browser it's very easy to see how your data is being transferred to servers via the padlock icon and tools like Firebug or Chrome dev can give you the information for things like ...
2
votes
1answer
420 views

Implementing account lock out on a website

A web vulnerability scanner on my website made a suggestion that I implement an account lockout mechanism for my site when there has been a certain number of invalid login attempts. I am trying to ...
2
votes
1answer
347 views

May Facebook and Google+ login make a site feel 'insecure'?

Lets say I have a website which handles your money in some way. So I know about your credit cards. Currently, user register using their national identification number. So all the users are real ...
2
votes
1answer
129 views

Prompting customer login before making changes to their account

In a project I'm working on, there's a service website where customers can register objects they own in order to use the service. If a customer owns many of these objects, all can be registered on the ...
2
votes
0answers
456 views

How to provide good mobile phone number verification? [closed]

I'd like to know if there is a way to achieve a good user experience when a user's profile contains a mobile number which needs to be verified via SMS. The examples I have explored had the mobile ...
1
vote
3answers
155 views

show ip history to login user

Show ip history, like last 100 logins IP and time, can be scare user? I think maybe user think why service provider store my IP? of course after some storing we can have fraud detection my solution ...
1
vote
1answer
85 views

Inform user of invalid email on password reset

Should the user be told if they enter an email which is not in the database? User forgets their password and clicks a link to reset it. Page displays "An email was just sent out to youremail@bla.com ...
1
vote
2answers
104 views

Should I use multiple '*' when typing in one character?

I am designing a secure password login page. I am thinking about outputting multiple * for one typed character. For example: User types: a Password field shows: ****** My rationale for this is ...