Hot answers tagged

109

If the user can type it then it should be allowed in their password. Telling someone what they can and can't use in their password always feels wrong to the user. Passwords are currently the most universal way to authenticate. Preventing users from entering anything is, in essence, telling them who they can or can't be. 1. Any printable character that a ...


45

You have to go with the first option (stating that the "username or password is invalid"), and this has nothing to do with security. Let's say that I usually use JohnGB as my username, but on your service someone else has that username, so I use JohnGB123 instead. Say I've then forgotten my username and I enter JohnGB as my username, but use my correct ...


36

If you are providing a valuable service/product there will always be people trying to "cheat" the system and get in. Providing a free trial period is an industry norm and over time users may sign up for more than one trial but that will get old fast. I would worry less about ensuring authentic users and focus more on providing that great content. If you're ...


33

If a site requires that passwords only contain certain character codes, then a user will be able to enter the password into almost any device which is capable of producing those characters. If the password contains character codes which may be entered on some devices but not on others, then a user who creates a password on a device which could enter the ...


30

It's better to use a special one-time login url. Reasoning: You want to make the process as easy as possible to have the lowest drop-off rate. Sending someone a temporary password requires them to either retype a password that they haven't chosen, or copy and paste it. It also provides no additional security benefits.


29

Cutting it down to a single step makes the process simpler and better fits existing conventions, so it's probably superior from a UX perspective. Each additional step you introduce is more work for the user. Add in the potential for users waiting between page loads (especially on mobile) and you're really just adding an additional inconvenient step in their ...


26

You shouldn't enforce the characters in passwords. Instead you should encourage passphrases which although longer are more secure and easier to remember. Instead of trying to explain this, I will let XKCD do it for me:


26

Let me post an answer contrary to existing ones. A "login successful" message is not just unnecessary but it's also wrong. Why Unnecessary Think if objects/devices you use in everyday life will give you feedback each time you use them: "OK, you're using right key, you can turn the car's engine on", "Welcome back Adriano, this is your house", "Your PIN is ...


24

Every constraint you add to a password pattern, the more cognitive load you add to a user. And constrains can be good to make a password secure. But how secure is a password that user constantly forget and as a consequence hit the “forgot password” workflow yet again. Further you minimize the option for users to use there already memorized secure password on ...


19

I would like to add to DaveAlger's point. I, like many people, create algorithms in order to better remember passwords. I've spoken to many people (in an informal manner) about passwords and I have heard a lot of objections why can't I use a part of my email or my username in my password? why is there a character limit? (affects my algorithm) why can't I ...


18

Workflow-wise, 1 step is a no-brainer. It's three fields and there's no reason to separate them. You can also nicely inline validate all 3 fields at once; what if my passwords don't match on the second screen in 2 step? Is my old password still valid? If not, that's a pain in the butt. If so, that's a potential security risk! Actually a two step seems ...


17

I'm going to give some advice from a Security standpoint + UX. I wouldn't sacrifice either one for the other. Have both. There's an important question of secure practices in your question. The Best Practice from a security standpoint is to not identify which entry was invalid, and have a generic answer. Let's ask What Would Google Do and take Google's ...


16

First of all, you shouldn't require such convoluted & complicated passwords. Instead, you should simply put a password strength meter next to the password field and let users decide whether they want a strong password or a weak one. Secondly, your system shouldn't have 2 different ways of dealing with wrong and/or invalid passwords. It should simply try ...


15

I think currently users are more comfortable with just signing up on site, however that's mainly because that's what most websites do. If done right OpenID and OAuth can work very well. The way StackExchange does it is particularly good. Explain what it is, show that if you have any of a certain type of account can you just press the button, and also what ...


13

This is a tough issue that I'm not sure anyone has really solved yet, but here are my thoughts for your 3 solutions. Phone number Yes this might be a bit personal or creepy but I feel like it's becoming less so since people are actually using their phones less and less. You'll want to be clear that you're not selling their phone number to a marketing ...


12

Consider using federated user authentication from some social network like Facebook or Twitter. You can suggest to your user that your use of social credentials is a service to them, saving them the hassle of remembering and maintaining a different username/password set for your site. Should they change their password on the social network, your site would ...


11

Jumping in with an answer because I've seen a really nice example of this in the wild. Hargreaves Lansdown is a UK financial institution, and here's how they do it: The idea of giving context to a user hadn't occurred to me before I saw this. In practice, I find it far faster and easier to input a password when I can see how far the requested characters ...


10

TL;DR - Most of the time I've seen people add this feature it's been pure security theatre. It hasn't helped the user and doesn't make the site safer. Avoid if possible. The long version... Personally - I'd start questioning whether this was actually a good feature to add. Is it actually making the system more secure? Are there better ways to make it ...


9

Usernames provide a "face" to the world. They're great on forums, etc. to hide the identity of the poster, or allow some personalization. However, for the purpose of logging in, e-mail seems universally better. Most sites I've seen with usernames have a "forgot username" button right next to the "forgot password" button, which should tell you why :-). For a ...


9

As a one-off authentication scheme it's okay, but the problem arises when you need to post more than one comment. You'd have to send the confirmation email each and every time. There's no client-side authentication, so there's no way to set up things like an avatar (unless you use Gravatars), display names, edit comments or post new comments without going ...


9

If any service can validate what the n-th character of your password is, it means that they are storing your password in an insecure format. No service should ever know what your password is, they should only be able to say whether your password authenticates or not. So you shouldn't ever ask for the n-th character of a password, and you shouldn't ever be ...


9

HSBC uses a combination of a username, password, and security key. In this implementation, you first enter your username. Next, you are prompted to enter your password and three random characters from your security key: download bmml source – Wireframes created with Balsamiq Mockups The benefit of this approach is that the password does ...


8

There are very few times when I feel it is appropriate to only have external logins. If what you're doing is tightly coupled with the service that you're using for a login (e.g. Klout using Facebook and Twitter), then I'm willing to make an exception. I know some of the Stack Overflow guys might disagree with this (see here), but I prefer to keep things ...


8

Honestly, a valuable product. You are not the first one to offer trials. You would scare more potential customers off than you would save through fraud-detection processes. If your customers like what you do, they will pay for it. If they use your software on a regular basis and still create a new account each time, they can't or don't want to afford it. ...


8

More than necessary, I think the word is convenient or recommendable. and of course, the message or its phrasing doesn't need to be the one you mention, as long as there's a clear indication of a change of status. The change of status is obviously the difference between logged and no logged, and it can be represented by messages (like yours), change of ...


7

Is it necessary to interrupt the user while they're in the middle of something? I think it would be better to wait until the current step is done. Two ways you can do that: Wait until they submit the form. Require authentication on an interstitial page, before continuing to the next step. Add the authentication to the bottom of the form.


7

It's good because it significantly decreases the user effort. For example, most people probably already have a Facebook, Google, etc account. Re-using it makes it way cheaper for people to register. Typically, registration is a surprisingly thick barrier. When The Times tried to get people to register to read the news, even without paying, their readership ...


7

Like you say password pattern enforcement is basically a good way to make sure that the user is going to invent a password that is optimised to be forgotten. This is especially true of rules that are quite complicated (one I recently came across demanded that the password have at least one capital letter, one digit, one special character, be at least 8 ...


6

You should ask for the entire password, not just because it is more secure, but because users entire passwords by muscle memory, especially passwords made up of arbitrary characters, or defined by movements across the keyboard. This makes it hard for users to recall characters in specific positions.


6

If you check "standard" login screens, like one Mac OSX or Android you can see that they usually don't rely on any headline at all. That's why I'd go with a simple "Suggested users:" as headline for the user list. In case somebody finds it too big-brotherish, you could add a small explanation on a secondary screen ("Who suggested these users?", or something ...



Only top voted, non community-wiki answers of a minimum length are eligible