How an application is kept secure to prevent unauthorized access.

learn more… | top users | synonyms

44
votes
10answers
3k views

What is the best way to inspire users to choose strong password?

Most of the users use weak passwords. They may use weak passwords even for services where they store sensitive information. I think it's because they don't believe that their password may be ...
22
votes
8answers
6k views

How to tell the user his login credentials are incorrect?

When a user has entered incorrect details into a login form, is it better to tell them: The username or password you have entered is invalid. or The user name you have entered is invalid (for ...
33
votes
5answers
4k views

Does a password strength indicator increase password strength?

Just browsing the internet, I saw a password strength indicator on a sign up, and I realized that I personally didn't care. Does anyone know if, on average, password strength indicators increase the ...
5
votes
5answers
760 views

Forgotten Passwords - is there a real benefit to asking for memorable password hints on signup?

On several signup forms I see fields such as "Choose your Memorable Password Question". Is this actually benifical nowadays? Surely a more secure method if someone forgets their password is to build a ...
10
votes
5answers
647 views

Does SSL on a company's website make the company appear more credible?

I recently had a thought about the way many modern browsers display information about a site's security certificates. At least Firefox shows a very noticeable blue box in the address bar on sites that ...
50
votes
10answers
5k views

Refusing a user permission to click a URL

I've been asked to work on a system message on an intranet where by there are various URLs (linking to lists of content) that have permission rights attached to them, so only certain users have access ...
23
votes
6answers
1k views

Forcing users to use a particular pattern for passwords

Many websites, specially government ones, enforce users to use a password which conforms to particular criteria. For example: use between 8-13 characters with at-least one integer and one capital ...
11
votes
3answers
1k views

Should I capture exceptions and present a nice error page to hackers? [closed]

If a hacker is trying to hack, should I present a pretty error page or redirect somewhere instead of a generic/cryptic error? I feel that the hacker knows what they are doing, I know what they are ...
11
votes
4answers
500 views

When is it right to use “Not <user>?”

Sometimes a site shows a message reading: "You are logged in as [user1]. Not [user1]? Please log out." When is it right to use such a thing? Where are we assuming someone is mistakenly logged in as ...
9
votes
3answers
784 views

Why did they use two-stage social media sharing buttons?

I recently visited a seemingly fairly reputable web site and was astonished to see their implementation of a two-stage trigger for their social media buttons: (The text appears when you hover over ...
9
votes
5answers
1k views

Login button - on homepage or separate page?

I ran across an article called Put the login on the front page, where the author wants sites to: [...]put the user name and password box somewhere obvious on the home page like the upper right ...
7
votes
3answers
465 views

Has Captcha become common knowledge?

I am doing a business site for a web company, and was wondering if Captcha has become so well-known, that it no longer needs an explanation ? Right now there is only a input box, the captcha image ...
7
votes
3answers
73 views

Accessing secure content

Which of the permutations for accessing secure content do folks prefer? In this instance I'm referring to a saved quote and have usernames, email addresses and quote reference numbers available. ...