How an application is kept secure to prevent unauthorized access.

learn more… | top users | synonyms

2
votes
2answers
166 views

Why is it that almost all anti-virus software has custom built skins?

I am yet to see an anti-virus software that's using the native Windows theme. Why do they prefer custom skins over native windows skins? Does it have anything to do with security and/or consistency? ...
2
votes
3answers
2k views

How to make a user feel secure when using an iframe for payments

I've got a site where it's very difficult for me to add SSL, so I'm using a secure iframe on the payment page to collect credit card details. Currently it's set up to appear like it's the same site. ...
2
votes
1answer
293 views

Why do some people physically cover their macbook cameras [closed]

Obviously, if a malicious user could save camera snapshots or streams you have a bigger issue on your hands than improperly lighted selfies. Or do they simply not get this / this isn't as commonly ...
2
votes
1answer
1k views

What's the advantage of disabling paste functionality for password input field? [duplicate]

Some web forms don't let the user paste text into password input fields. For example I just noticed this on Apple's iTunes Connect website: https://itunesconnect.apple.com/ I don't see any ...
2
votes
4answers
123 views

How to best inform user they cant use the service for a period of time after registering?

For security reasons, after registering we cant let the user actually use the product until 14 days have past. Right now I'm just appending a message at the end of the form (Ann#3) - is there a ...
2
votes
1answer
57 views

In Single Sign On what does SAML “enabled” control do or mean?

I am currently working on the redesign of SSO signup process/form and want to understand what enabling SAML control implies. The rationale being that if an organisation does not have SSO enabled the ...
2
votes
1answer
75 views

Should Operating Systems Hide Sizes of Files/Folders the User is Denied Access to?

If there are files or folders the current user should be denied access to, should their sizes be displayed when the user asks, for example with the ls -l command on Linux or the places the Windows ...
2
votes
2answers
289 views

How does the perception of website data being insecure affect usability?

If the user perceives that data entered into a website is insecure (if it is perceived that it can be hacked, stolen or tampered with), how is the usability of the site affected? This question is in ...
2
votes
1answer
45 views

How to prompt users to install app from supported source?

Sometimes, users find and install our app from unsupported sources. These alternative sources may have been tampered with. How should users be prompted to download the official app from the app store/...
2
votes
4answers
314 views

How to increase trust and security feeling when collecting bank information

I have a site that needs to collect a user's bank username/password. This is obviously a big hurdle for someone to get over but we have to do that. I'm looking for ways, visually & textually, to ...
2
votes
4answers
119 views

Should you be allowed to change your own data?

Let's imagine you were about to use a CRM Enterprise-Application that contains your working-data (street, housenumber, office phone number and so on). Should we allow the user to change this data at ...
2
votes
1answer
90 views

Can providing articles on security improve the perception users have of the security of a website?

I also know many who turns off scripting (JavaScript) from running on their system and won't open any website without HTTPS or any security protocol. Whenever I read about Facebook updating its ...
2
votes
1answer
86 views

Is there a best practice for allowing support rep to login to a user's account?

I'm updating a product that previously had a single checkbox to allow our support team to login to the user's account. Once in, the support rep had full admin level permissions. The product deals ...
2
votes
1answer
175 views

Automatic login on password reset

This question has been raised on http://security.stackexchange.com/questions/40723/why-do-you-need-to-login-after-you-change-a-password - With security in mind As one user states: "From a security ...
2
votes
1answer
46 views

Is there a standard for informing users about SSL/HTTPS on Android/iOS?

On a standard web browser it's very easy to see how your data is being transferred to servers via the padlock icon and tools like Firebug or Chrome dev can give you the information for things like ...
2
votes
1answer
709 views

Implementing account lock out on a website

A web vulnerability scanner on my website made a suggestion that I implement an account lockout mechanism for my site when there has been a certain number of invalid login attempts. I am trying to ...
2
votes
1answer
402 views

May Facebook and Google+ login make a site feel 'insecure'?

Lets say I have a website which handles your money in some way. So I know about your credit cards. Currently, user register using their national identification number. So all the users are real ...
2
votes
0answers
637 views

How to provide good mobile phone number verification? [closed]

I'd like to know if there is a way to achieve a good user experience when a user's profile contains a mobile number which needs to be verified via SMS. The examples I have explored had the mobile ...
1
vote
3answers
190 views

show ip history to login user

Show ip history, like last 100 logins IP and time, can be scare user? I think maybe user think why service provider store my IP? of course after some storing we can have fraud detection my solution ...
1
vote
3answers
109 views

When entering data, should the user be authenticated on clicking “Create” or “Save”?

Having the two options: Check if user authenticated upon "Save" button click (when the input dialog is shown and filled in with the data) Check if user authenticated upon "Create" button click (...
1
vote
1answer
162 views

Inform user of invalid email on password reset

Should the user be told if they enter an email which is not in the database? User forgets their password and clicks a link to reset it. Page displays "An email was just sent out to youremail@bla.com ...
1
vote
2answers
108 views

Should I use multiple '*' when typing in one character?

I am designing a secure password login page. I am thinking about outputting multiple * for one typed character. For example: User types: a Password field shows: ****** My rationale for this is ...
1
vote
4answers
86 views

What is a 'best-in-class' credential reset pattern?

When we design secure systems there is always a tension between memorability, security and cost (e.g. Calls to a call centre). Until recently, I've always tackled this by getting users to set up ...
1
vote
2answers
77 views

Dynamic Billing Information Validations In Checkout System

I'm unsure if this is more of a UX or security oriented question, but here goes nothing. I'm currently trying to simplify my e-store's checkout process by adding dynamic client side validations using ...
1
vote
3answers
99 views

Good way to help the user remembering the password strategy [duplicate]

Nowadays sites have different password strategies. In example: Facebook: 6 characters min, no restriction Ameli.fr: 8 characters min, all should be numbers. StackExchange: 8 characters min, upper ...
1
vote
2answers
90 views

Does a crime security alert app need its users to register?

I was asked to work on a police security alert system as a school project. The app notifies a user about security info and lets users (citizens of a place) notify police agencies around them. I was ...
1
vote
1answer
68 views

Displaying the actual encrypted data or replace its value with wild card

So we have a column on a table where we display different user names and their recent daily activities. The admin has the option to encrypt the actual user names due to privacy concerns. The current ...
1
vote
2answers
127 views

UX failure in Apple's security update process

It would have been much better if I could download the 700+ MB download in the background while continuing to work and THEN pull the trigger on applying the patch. There are no real reasons to couple ...
1
vote
2answers
606 views

Should I show a customer granular credit card errors?

When credit cards are declined, our gateway usually provides a useful reason: insufficient funds, CVV mismatch, invalid card number, etc. Should we show this to the user? Or should we just show a ...
1
vote
1answer
68 views

Can you use similar security questions used on email registration for a more corporate tool?

I am developing a set of security questions for a corporate website. The usual security questions I come across are mothers birthplace, best childhood friend, ect. These questions don't seem fitting ...
1
vote
2answers
32 views

How do I mitigate the risks of user-generated data when not requiring authentication?

I'm creating a web project where users can add markers on a map. I'm dealing with a demographic who are used to instant-gratification. I want to keep the threshold for engagement as low as possible so ...
1
vote
3answers
78 views

What's the best way to validate an invited user via email that another user provided?

User 1 is an account administrator and can create (invite) other users on the account. User 1 inputs an email address for User 2. User 2 receives a welcome email at that address with a link to confirm....
1
vote
3answers
87 views

How to express that a form is part of a authenticity process?

I'm working on an app so user can ensure the products they are going to buy is not counterfeit and tracks its shipping. Tests To do so, we went for a form where people input a product's security ...
1
vote
1answer
110 views

Hierarchical display of categories when the user is not exploring

We are making an in-house application intended for sharing know-how. It is a sensitive topic, because sharing with one's business partners makes work easier, but there are many (politically powerful) ...
1
vote
1answer
169 views

How to encourage users to download an app to complete strong authentication (two factor)

I'm designing a strong authentication (two factor) solution for a website. Users will be forced to use two factor (legal requirement). We have two supported methods an SMS verification code texted to ...
1
vote
1answer
1k views

Prevent Active Directory password expiration when user never logs in

Let's assume the following in a hospital: Each nurse has her own Active Directory user, with a password. The password expires automatically 90 days after the password was set. A nurse uses her own ...
1
vote
1answer
57 views

Verify authenticity of a digital ticket

Let's say there's an app for a fair. This fair has a bunch of vendors. The user sees the store catalog for each vendor and make purchases directly from the app. All he has to do is come and pick up ...
1
vote
1answer
55 views

How should I visualize a name mismatch for a SSL website?

I am writing custom security software and need to design a better method for a name mismatch... where the server certificate doesn't match the address in the URL. How should I visualize this to the ...
1
vote
1answer
43 views

How best to provide contact info in a member directory while preventing 'data harvesting'?

I am working on a searchable online directory. People will use it to find other members, service providers, and the like. It's critical that the results include contact data. However, my clients are ...
1
vote
1answer
401 views

Best practice for two-step verification process

Perhaps due to the recent incidents behind hacking of user database and identity theft, many organizations have introduced the two-step verification process, in particular when users are accessing the ...
1
vote
3answers
408 views

What happens in a web browser when a download is started via Javascript?

In a web browser, a download can be initiated immediately after user input, or started via Javascript after a set amount of time and/or being redirected to another page. I want to provide users with ...
1
vote
1answer
95 views

Installing recording software

On an upcoming visit to a user's place of work, I would like to have them install Morae Recorder beforehand. This is likely to be a problem for the user's IT Security people. In the past, especially ...
1
vote
1answer
35 views

Login for hookups app

I'm developing an android app for hook ups with strangers, I understand that Facebook/Twitter login are not appropriate, but between security and flexibility, I'm confused how to register new users, I ...
1
vote
1answer
59 views

Yahoo forbidden links

When I surf with my iPad or Mac, I find this message almost every day: This basically happens because Safari opens where you left, so I know the link is safe since it's a search I did at Yahoo ...
1
vote
1answer
49 views

Site examples which allow users to expose password field [closed]

I'm looking for some real world sites where the login control allows users to view the text inside the password field. I'm looking for examples of site-generated "Show Password" controls, not examples ...
1
vote
0answers
136 views

MarkDown Editor : Client side or Server Side or Both? [closed]

Planning to implement MarkDown Preview UI + Markdown Support for a chat application in development. Web framework is python-tornado MarkDown Lib i am looking is : remarkable (Faster than commonmark ...
1
vote
1answer
142 views

Is there an established way of representing Single Sign On with an icon? [closed]

I'm wracking my brains trying to think of representing Single Sign On iconographically. Is there a common way this is done?
0
votes
3answers
411 views

Should a web browser indicate “year” near the lock icon to encourage more safe/secure website?

There are many important technologies coming to web browsers in the next few years. Not to mention that where we are today is a culmination of lessons learned and several security pitfalls. However, ...
0
votes
1answer
186 views

Optional password field on login

We want all users to enter their employment ID so we can identify them, but it's not so important that we require them to register or remember a password. Some users will be registered for the ...
0
votes
2answers
778 views

Usability vs. Security [closed]

This question has started to preoccupy since read Stevey's Google Platforms Rant by Steve Yegge. (The original post was removed.) Among many other things he asserts that usability is more important ...