How an application is kept secure to prevent unauthorized access.

learn more… | top users | synonyms

2
votes
0answers
437 views

How to provide good mobile phone number verification? [closed]

I'd like to know if there is a way to achieve a good user experience when a user's profile contains a mobile number which needs to be verified via SMS. The examples I have explored had the mobile ...
3
votes
3answers
2k views

Case sensitive vs case insensitive passwords

My website has always used case insensitive passwords for millions of users. The security specialist is pushing us to change to case sensitive passwords. Are there any studies or best practices on ...
15
votes
5answers
2k views

Should I use two steps or one when users change password?

I currently have a page dedicated to changing passwords. There are 2 options: A 2 step option: download bmml source – Wireframes created with Balsamiq Mockups download bmml ...
5
votes
2answers
123 views

What are the conventions for how often a user should be asked to log into a mobile application?

Or put another way - is there a process for deciding how long a user's authenticated session should last?
4
votes
1answer
123 views

Encryption of chat messages and possibility of password loss

I have a client-server chat like app. I would like to add an encryption of messages for users. So, that they will be sure that no one, even service owner, can read their confidential information. I'm ...
3
votes
1answer
255 views

Are there specific standards, guidelines, and processes UX in security?

There are a number of resources with well-defined standards and practices for UX, and there are principles in security relevant to UX such as the principle of Psychological Acceptability. However, as ...
4
votes
2answers
601 views

Forgot Password Alternatives?

Does anyone know of a good alternative to the Forgot Password link on login forms? I'm not looking to eliminate the link, but to provide an alternate method for retrieving lost passwords. Our current ...
6
votes
2answers
519 views

Should we require confirmation before resetting a password?

If a user has forgotten their password for a service, the convention is that they should need only their username and/or registered email address in order to reset their password -- in our case that ...
11
votes
4answers
507 views

When is it right to use “Not <user>?”

Sometimes a site shows a message reading: "You are logged in as [user1]. Not [user1]? Please log out." When is it right to use such a thing? Where are we assuming someone is mistakenly logged in as ...
2
votes
4answers
120 views

How to best inform user they cant use the service for a period of time after registering?

For security reasons, after registering we cant let the user actually use the product until 14 days have past. Right now I'm just appending a message at the end of the form (Ann#3) - is there a ...
5
votes
2answers
210 views

How can I reassure users about an unfamiliar domain name?

I have a service, example-service.com. I have customers customer-a.com, customer-b.com, etc. We host a service for them on urls like customer-a.example-service.com Users who are familiar with ...
10
votes
3answers
889 views

Why did they use two-stage social media sharing buttons?

I recently visited a seemingly fairly reputable web site and was astonished to see their implementation of a two-stage trigger for their social media buttons: (The text appears when you hover over ...
52
votes
10answers
5k views

Refusing a user permission to click a URL

I've been asked to work on a system message on an intranet where by there are various URLs (linking to lists of content) that have permission rights attached to them, so only certain users have access ...
5
votes
1answer
420 views

Usable examples, recommended practices for interfaces optimized for using pass-phrases instead of passwords

Reading through What is the best way to inspire users to choose strong password?, I realized I have never used an interface where the primary login password system would use pass-phrases (and where ...
46
votes
10answers
4k views

What is the best way to inspire users to choose strong password?

Most of the users use weak passwords. They may use weak passwords even for services where they store sensitive information. I think it's because they don't believe that their password may be ...
8
votes
1answer
313 views

During sign ups, how to best instill confidence that email addresses will be safe

Many sign up forms will ask you for an email address so that they can contact you. Even the most minimal sign-up (other than no sign up) will need an email address to send you a validation email. ...
17
votes
6answers
925 views

Should validating an email automatically sign someone into an application?

When signing up for a new account with a web application, it is standard to send a validation email. I don't want to go into the pros and cons of the validation email though. When receiving a ...
1
vote
1answer
129 views

Is there an established way of representing Single Sign On with an icon? [closed]

I'm wracking my brains trying to think of representing Single Sign On iconographically. Is there a common way this is done?
0
votes
2answers
616 views

Usability vs. Security [closed]

This question has started to preoccupy since read Stevey's Google Platforms Rant by Steve Yegge. (The original post was removed.) Among many other things he asserts that usability is more important ...
0
votes
2answers
138 views

User testing browser add-on

I'm working on a browser add-on that has some novel usability ideas, and I'd like to test them out on some users. The add-on interacts with the user's password data and usage, and I'd like to collect ...
5
votes
1answer
271 views

What is the benefit of fixed security questions?

Many sites/services seem to make use of a security question as a way of accessing an account if you lose your password or email access. As an example, Facebook uses this form: There isn't a ...
6
votes
5answers
893 views

Forgotten Passwords - is there a real benefit to asking for memorable password hints on signup?

On several signup forms I see fields such as "Choose your Memorable Password Question". Is this actually benifical nowadays? Surely a more secure method if someone forgets their password is to build a ...
26
votes
8answers
12k views

How to tell the user his login credentials are incorrect?

When a user has entered incorrect details into a login form, is it better to tell them: The username or password you have entered is invalid. or The user name you have entered is invalid (for ...
11
votes
5answers
779 views

Does SSL on a company's website make the company appear more credible?

I recently had a thought about the way many modern browsers display information about a site's security certificates. At least Firefox shows a very noticeable blue box in the address bar on sites that ...
5
votes
2answers
258 views

Password and in place editing

I decided to support in place editing for a simple user table. I am not sure what i should do about password... When i create a new user i can have a textbox to type... When viewing i can hide then ...
0
votes
3answers
311 views

Should a web browser indicate “year” near the lock icon to encourage more safe/secure website?

There are many important technologies coming to web browsers in the next few years. Not to mention that where we are today is a culmination of lessons learned and several security pitfalls. However, ...
3
votes
2answers
280 views

How to handle creating new account with email address that is unverified on another account?

We have email address verification on our accounts. Users have to verify their email addresses when they create their accounts and when they update their email addresses on existing accounts. With new ...
5
votes
3answers
564 views

Use UAC Shield icon to indicate (non-Windows) elevation will be required?

i am working on financial software where there are many times where a "supervisor" is required to authorize that the user can continue, e.g.: user wants to void a funds transfer user has a variance ...
7
votes
3answers
563 views

Has Captcha become common knowledge?

I am doing a business site for a web company, and was wondering if Captcha has become so well-known, that it no longer needs an explanation ? Right now there is only a input box, the captcha image ...
2
votes
5answers
682 views

Limiting customer credit cards to a single account

Is it a good idea to limit a customer's credit card so that it can only be used on one user account? The user can have as many credit cards associated with their account as they like, but they cannot ...
9
votes
5answers
1k views

Login button - on homepage or separate page?

I ran across an article called Put the login on the front page, where the author wants sites to: [...]put the user name and password box somewhere obvious on the home page like the upper right ...
8
votes
3answers
882 views

Usability and security for user access and password handling in a web application?

I'm looking at putting together a website aimed at ordinary users that will handle personal data which I don't want to be compromised. How can I make the site secure but also usable? It seems most ...
7
votes
3answers
86 views

Accessing secure content

Which of the permutations for accessing secure content do folks prefer? In this instance I'm referring to a saved quote and have usernames, email addresses and quote reference numbers available. ...