How an application is kept secure to prevent unauthorized access.
47
votes
10answers
4k views
Refusing a user permission to click a URL
I've been asked to work on a system message on an intranet where by there are various URLs (linking to lists of content) that have permission rights attached to them, so only certain users have access ...
42
votes
17answers
5k views
Computer login with password only, without username
I have an idea to simplify the login screen on things like home computers with a small number of users (say, 2-10) with passwords.
Today, a typical home computer's login screen has three steps:
...
42
votes
10answers
2k views
What is the best way to inspire users to choose strong password?
Most of the users use weak passwords. They may use weak passwords even for services where they store sensitive information. I think it's because they don't believe that their password may be ...
40
votes
11answers
3k views
Is a “Never tell your password to anyone” message in chat really necessary?
In almost every chat window I open, there's this fairly obvious statement:
Never tell your [password/credit card/social security/etc] to anyone.
Are there some standards for chat functionality that ...
24
votes
5answers
879 views
Should a user be logged in after resetting their password?
Lets assume following flow:
I want to log in
I don't remember password
I click on the "forgot my password" link (email is dispatched)
I check my inbox and click on the link
I type in password and ...
22
votes
6answers
892 views
Forcing users to use a particular pattern for passwords
Many websites, specially government ones, enforce users to use a password which conforms to particular criteria. For example: use between 8-13 characters with at-least one integer and one capital ...
16
votes
6answers
476 views
Should validating an email automatically sign someone into an application?
When signing up for a new account with a web application, it is standard to send a validation email. I don't want to go into the pros and cons of the validation email though.
When receiving a ...
16
votes
4answers
843 views
What good is this moving captcha from Apple
A Hacker News article pointed me to http://www.apple.com/itunes/50-billion-app-countdown/entry-form/ where they use moving captchas:
I assume that its a way to make shorter (and therefore ...
15
votes
5answers
886 views
Should I use two steps or one when users change password?
I currently have a page dedicated to changing passwords. There are 2 options:
A 2 step option:
download bmml source – Wireframes created with Balsamiq Mockups
download bmml ...
14
votes
8answers
2k views
How to tell the user his login credentials are incorrect?
When a user has entered incorrect details into a login form, is it better to tell them:
The username or password you have entered is invalid.
or
The user name you have entered is invalid (for ...
11
votes
4answers
478 views
When is it right to use “Not <user>?”
Sometimes a site shows a message reading: "You are logged in as [user1]. Not [user1]? Please log out."
When is it right to use such a thing? Where are we assuming someone is mistakenly logged in as ...
9
votes
5answers
704 views
Login button - on homepage or separate page?
I ran across an article called Put the login on the front page, where the author wants sites to:
[...]put the user name and password
box somewhere obvious on the home page
like the upper right ...
8
votes
1answer
232 views
Why does MediaWiki put little padlocks on HTTPS links?
Does anyone know why MediaWiki puts little padlock icons next to HTTPS links? For example, if I put this link in a wiki article: https://twitter.com/harry_wood it would get a little yellow padlock by ...
8
votes
3answers
501 views
Why did they use two-stage social media sharing buttons?
I recently visited a seemingly fairly reputable web site and was astonished to see their implementation of a two-stage trigger for their social media buttons:
(The text appears when you hover over ...
8
votes
4answers
392 views
Does SSL on a company's website make the company appear more credible?
I recently had a thought about the way many modern browsers display information about a site's security certificates. At least Firefox shows a very noticeable blue box in the address bar on sites that ...
8
votes
2answers
170 views
Why would one limit username format?
Many websites when ask you to create a new "username", will limit you in some way, most often like "username should only contain letters and underscores" or something alike.
This results in inability ...
8
votes
2answers
177 views
how can you improve the appearance of security
What are the different ways to make users (especially paranoid one's like me) feel safe about the security aspect of the site?
8
votes
6answers
382 views
How to handle “forgot password” when user has not confirmed email?
If you follow the pattern of allowing users access to your application without having confirmed an email (generally considered good UX), how do handle the case where they forgot their password? Very ...
7
votes
3answers
389 views
Has Captcha become common knowledge?
I am doing a business site for a web company, and was wondering if Captcha has become so well-known, that it no longer needs an explanation ?
Right now there is only a input box, the captcha image ...
7
votes
1answer
182 views
During sign ups, how to best instill confidence that email addresses will be safe
Many sign up forms will ask you for an email address so that they can contact you.
Even the most minimal sign-up (other than no sign up) will need an email address to send you a validation email.
...
7
votes
2answers
154 views
Does inline validation at login create a security risk or a perception of one?
When a user types their email address into a login form, I'd like to validate inline whether the email is associated with an account. The idea here is that, in the system in question, a large ...
6
votes
3answers
51 views
Accessing secure content
Which of the permutations for accessing secure content do folks prefer? In this instance I'm referring to a saved quote and have usernames, email addresses and quote reference numbers available.
...
6
votes
3answers
447 views
Usability and security for user access and password handling in a web application?
I'm looking at putting together a website aimed at ordinary users that will handle personal data which I don't want to be compromised. How can I make the site secure but also usable?
It seems most ...
6
votes
2answers
263 views
Should we require confirmation before resetting a password?
If a user has forgotten their password for a service, the convention is that they should need only their username and/or registered email address in order to reset their password -- in our case that ...
5
votes
5answers
518 views
Forgotten Passwords - is there a real benefit to asking for memorable password hints on signup?
On several signup forms I see fields such as "Choose your Memorable Password Question". Is this actually benifical nowadays? Surely a more secure method if someone forgets their password is to build a ...
5
votes
3answers
161 views
Logging in with email only
I'm working on a blog and there will be an option to post a comment.
I could implement registration with username, password and email — the standard way. I could implement 3rd-party authorization ...
5
votes
3answers
205 views
Should an admin decide what users can do, or should he decide what not to do?
Which one is better option for an admin from a usability point of view?
Suppose if a system is supposed to authorize a user to have access (and different type of access like read only or read write) ...
5
votes
2answers
171 views
How can I reassure users about an unfamiliar domain name?
I have a service, example-service.com.
I have customers customer-a.com, customer-b.com, etc.
We host a service for them on urls like customer-a.example-service.com
Users who are familiar with ...
5
votes
2answers
168 views
Password and in place editing
I decided to support in place editing for a simple user table.
I am not sure what i should do about password...
When i create a new user i can have a textbox to type...
When viewing i can hide then ...
5
votes
1answer
189 views
Usable examples, recommended practices for interfaces optimized for using pass-phrases instead of passwords
Reading through What is the best way to inspire users to choose strong password?, I realized I have never used an interface where the primary login password system would use pass-phrases (and where ...
5
votes
1answer
142 views
What is the benefit of fixed security questions?
Many sites/services seem to make use of a security question as a way of accessing an account if you lose your password or email access.
As an example, Facebook uses this form:
There isn't a ...
5
votes
2answers
97 views
What are the conventions for how often a user should be asked to log into a mobile application?
Or put another way - is there a process for deciding how long a user's authenticated session should last?
4
votes
3answers
205 views
Norton Safe Web Verification — Impact on User
I have a client who insists on getting their website validated by Norton Security Verification and displaying the seal. However, I am skeptic and do not trust Norton products. I recall an impression ...
4
votes
3answers
372 views
Use UAC Shield icon to indicate (non-Windows) elevation will be required?
i am working on financial software where there are many times where a "supervisor" is required to authorize that the user can continue, e.g.:
user wants to void a funds transfer
user has a variance ...
4
votes
4answers
125 views
Security issues if not forcing a user to sign up
I've built a simple web app Flask.io that enables users to create and share to-do lists.
It doesn't require sign up. This is an important differentiator. I don't want to force the user to register ...
4
votes
3answers
242 views
Should we ask for name on card even though it's not required for credit card payments?
The name on card is not used when processing credit card payments. Paypal does not ask the user to enter the name on card when saving a card to the "wallet", while Amazon.com does.
The benefit of ...
4
votes
1answer
85 views
Encryption of chat messages and possibility of password loss
I have a client-server chat like app. I would like to add an encryption of messages for users. So, that they will be sure that no one, even service owner, can read their confidential information. I'm ...
4
votes
2answers
226 views
Forgot Password Alternatives?
Does anyone know of a good alternative to the Forgot Password link on login forms? I'm not looking to eliminate the link, but to provide an alternate method for retrieving lost passwords.
Our current ...
4
votes
1answer
62 views
Should link to restore user account lead him to login page?
Pinterest has a deactivate my account function.
After user deactivates his account, he gets an email with Reactivate account link:
Here Reactivate button links to login form with username and ...
3
votes
2answers
192 views
How to handle creating new account with email address that is unverified on another account?
We have email address verification on our accounts. Users have to verify their email addresses when they create their accounts and when they update their email addresses on existing accounts. With new ...
3
votes
2answers
67 views
studies on passcode/keypad versus password/keyboard?
When designing a tablet-based app that needs it's own extra security, there seems to be a couple of common choices: add a password screen with a keyboard, or use a passcode screen that has a keypad.
...
3
votes
3answers
291 views
Input mask on credit card number & SSN
Our company is discussing the use of an input mask (asterisk) on credit card numbers and social security numbers.
I'm completely against masking the CCN, from a UX perspective, especially since our ...
3
votes
3answers
166 views
Case sensitive vs case insensitive passwords
My website has always used case insensitive passwords for millions of users. The security specialist is pushing us to change to case sensitive passwords. Are there any studies or best practices on ...
3
votes
2answers
79 views
Login mechanism for multiuser smart-phones/tablet
What should be the mechanism for login in a shared smartphone or tablet? Should it be username + password as it is in PCs or should be enough using a password / PIN?
I'm interested on both security ...
3
votes
1answer
97 views
Unlock Account for Highly Secure Website
I am working on project for a very secure sensitive website in which the objective is to make the "unlock account" workflow easy and intuitive. Currently, if user enters wrong username and password ...
3
votes
1answer
114 views
Are there specific standards, guidelines, and processes UX in security?
There are a number of resources with well-defined standards and practices for UX, and there are principles in security relevant to UX such as the principle of Psychological Acceptability. However, as ...
2
votes
5answers
430 views
Limiting customer credit cards to a single account
Is it a good idea to limit a customer's credit card so that it can only be used on one user account? The user can have as many credit cards associated with their account as they like, but they cannot ...
2
votes
3answers
147 views
How to make a user feel secure when using an iframe for payments
I've got a site where it's very difficult for me to add SSL, so I'm using a secure iframe on the payment page to collect credit card details.
Currently it's set up to appear like it's the same site. ...
2
votes
1answer
104 views
What's the advantage of disabling paste functionality for password input field? [duplicate]
Some web forms don't let the user paste text into password input fields.
For example I just noticed this on Apple's iTunes Connect website:
https://itunesconnect.apple.com/
I don't see any ...
2
votes
3answers
186 views
Limiting access before email address is confirmed
I'm making a directory site and I'm considering having the following setup for email confirmation:
After registering, user has x hours to confirm their email. They're sent immediately to the next ...
