Tag Info

New answers tagged

1

I agree: Stop making people confirm passwords, especially from Mobile. Second, yes, display in Plaintext. Some good reading on password security and masking: http://www.nngroup.com/articles/stop-password-masking/ It's time to show most passwords in clear text as users type them. Providing feedback and visualizing the system's status have always ...


0

There is a third option used on some systems where only the most recently typed character is visible for around half a second - as soon as the user adds another character or the time passes 0.5 seconds, the character turns into a bullet symbol - This is my personal favourite as it requires not intervention from the user to either activate or deactivate it.


3

This question has been asked multiple times throughout the StackExchange network over the years. Here's a summary of answers: There's no clear research on the subject. If you're in the financial industry and have to be PCI compliant, the limit is 6 attempts. A brute force attack can be recognized using an algorithm. Follow this guide to create an algorithm ...


0

From a usability perspective? Infinite. With help being clearly highlighted to the user. From a security perspective? That's one for the security stack exchange really. Though Andrew's answer seems good.


1

Maybe you should try something different? For example in iPads and probably other Apple mobile devices for three invalid login tries you gets 5 minute penality and for every next try you gets that penality longer. Also there are more and more mobile apps which are not using typed password but some touch gestures instead. This solution eliminates brutal ...


3

Rather than simply invalidating the password it might be worth implementing a similar strategy to the one that Android uses in it's own system: From memory I believe it uses a rule of 5 attempts before instituting a 5 minute lock-out. If another 5 failed attempts occur then the lock out time increases (I'm not sure what to as I've never failed that second ...


33

There are a number of variations of the the "unmasking eye" icon but they mostly have the same issue, below are some examples: I have done some usability testing on this specific problem and many users I have tested with didn't even notice the "unmasking eye" there is also some issues with how to best convey the state of the password (masked/unmasked) ...


2

The two leading standalone password managers are LastPass and 1Password, so much of the info comes from them or deals with them. Also most of it isn't very recent :) In 2011 LastPass said that a security breach on their service had compromised the data of 1.25 million users. Also in 2011 Stu Helm, who was associated with 1Password, estimated on Quora that ...


0

Limiting allowed characters in passwords to a sane subset of printable characters is a good idea. More flexibility is not always better. That's why we have speed limits on roads. Frequently, usability is about protecting users from their natural aptitude for shooting themselves in the foot. From a server-side security standpoint, there is no problem in ...


1

Although I agree that a link is better than a temporary password in a plain text mail, I'd like to add that, as a user, I'm kind of afraid of those links, specially when I'm trying to recover my password by my own, by searching old e-mails of the website in my inbox. The URL is usually long, with many codes and I'm not sure if the web site will behave well ...


-4

the form is called reset password form, not email me a temporary password form. there's your answer right there



Top 50 recent answers are included