New answers tagged

1

You need to take into consideration: how often users login and how likely they are to remember any credential how sensitive the information is (both financially and legally) whether federated authentication is an option or you need a specific form of id verification (e.g. legal proof of address) I suppose you are authenticating households rather than ...


-1

Wow! It sounds like you're planning to store the password for direct checking - this is such a bad idea I don't know where to start! - No secure system should store users passwords. Most modern secured system do not know what your password is: When you enter a password, the system uses a one-way mathematical operation to arrive at a new string. This new ...


-1

Good arguments above, but I guess to faster the process and since they are not much into the technology or using the machines, generate password with medium length A-Z, 0-9 without special characters and display it for them upon completion, as well as send an email with the generated password and give them link to change the password if needed.


4

The best way is to let the user set a password. Why? Most people know why all accounts are safeguarded with passwords, be it people with good technical backgrounds, or none at all. They have ATM pins, bank passwords and even employment account passwords. So they will not get confused with the request for a password and why it is needed. The user should ...


4

I think the third option is the best way to handle it if you want to split the process in two steps. You can display a message after the first step to notify the user he need to update soon the profile and set the password. Sending a password in email isn't secure and the user will have to change it immediately after logging in anyway. You can read about ...


0

..." which is also recommended as a better solution in the accepted answer to the BBC question." Contrary to what I (and others) assumed, some studies have found passphrases aren't any better than passwords: Keith, Mark, Benjamin Shao, and Paul John Steinbart. "The usability of passphrases for authentication: An empirical field study." International ...


1

People don't want to make an effort creating complex passwords because they don't have one password, they have twenty or more... My answer would be very similar to one I gave here on how to engage users in adopting a password manager. You can suggest the use of a password manager tool (and ensure your site can deal with the very long passwords they ...


1

I'd suggest that one key is to show them how they can easily choose a more secure password without making it difficult to remember. I've done this with four simple questions - shown here with one set of answers. Choose some kind of critter ... Ferret Choose an unusual characteristic for a Ferret ... Slimy Choose a number ... Three Choose a colour ... ...


5

Okay, regardless of whether you're just talking to someone about it (because they've had a whinge about passwords etc) or you're trying to present a better user interface on a website or some app, I think the best approach is to just use natural language. In 2010 I facilitated a session around IT security in workplaces and the approach I came up with that ...


1

If you want to look at this from a behavioural perspective, we know that people generally need the specific type of motivation that will make them do or not do something. Generally speaking I think they fall into four categories: The carrot category: give them a sweetener to do something if they are wanting a reward for the effort - probably the best user ...


0

This is for your safety. Your identity (username) needs to be separated from your password because those 2 things are handled by different systems: Google is moving towards strengthening the second part (passwords) with new technology, which doesn't work if it's all on one page. The core problem is theft: with both in one place, it's too easy to steal ...


2

Never provide an attacker with any clue whatsoever to his only question: "What account credentials may be valid?" This is a problem comparable to the error message that one would show when a login fails. You shoudl never state things like "Wrong password" or "Wrong username". Use phrases like "Wrong credentials" or "Wrong username/password combination". ...


7

No, please don't First of all, I'd try to study and test if I need a captcha. And I mean, test it thoroughly. While Captcha are an obvious enhance in security, they have severe issues in terms of usability. see the docs below: Usability of CAPTCHAs - Or usability issues in CAPTCHA design Recent Findings On Captcha & The User Experience CAPTCHA Can ...


10

If you clear the password field when you have a faulty password, then it should clear the password field on a faulty CAPTCHA too and it should not specifically state that it was the CAPTCHA that was wrong while the rest were valid. Why? In case of using CAPTCHA — i.e. you are expecting bots to come knocking on your door and you wish to turn them away — ...


-1

As per my point of view, captcha and password fields are not related to each other. Because captcha means you are checking that details entered by human or machine(robot). First decide that what's your priority password or captcha? If you car giving constrain such like user can't login without correct captcha then there is no need to remove password field. ...



Top 50 recent answers are included