Tag Info

New answers tagged

0

Absolutely Not Login attempts lock after a few attempts (or they better, otherwise an attacker could break in trying the top 100 likely passwords), at least for a few minutes. Users would be very confused, I think, if registration screens locked after a few attempts, and by not logging them in, you give the attacker a clue that they password was wrong, so ...


0

Yes and no. You should let the user know that the email already has an account associated with. They should then be able to switch to login without retyping anything. The God Login Shows this well, Using just email and password fields while having multiple buttons for the different actions. Hiding the signup button on the login page, is also acceptable as ...


0

No, because you just doubled the attack surface. Request the user enter an identifier. Atomically check if the identifier already has credentials. If so, offer three choices: Go to login form Go to forgotten credentials form Resubmit a new identifier Same effect as you proposed, but the login barrier remains in exactly one place. Being in one place, ...


1

Good for mobile UX Another scenario to consider when entering a password twice is a good thing is when people sign up using a mobile device, have you ever tried typing a secure password (non word/phrase) 10x in a row without errors on a mobile device? Well sure, you and me can probably do it, but MOST cannot.


0

Why unmasking the password might be bad Shoulder surfing hazard, someone might see the passowrd on the screen as it is being typed if it is unmasked Unmasking doesn't help sometimes if your password is complex, you might still type something thinking you typed something else Why repeating the password is good You can never make a mistake as the ...


1

The benefit of asking for the password twice during registration is that, if a user does not use a password manager or writes passwords down, it is easier for him to memorize the chosen password. In German there is a saying like that knowledge goes from the hands straight into memory. So if you have already typed the password 2 times during registration ...


27

Yes, log the user in There are several ways an existing user might end up on a sign-up page: User clicks sign up by mistake User recently signed up for an account and the browser URL autocomplete takes user back to that URL (most recent) User forgot they signed up previously and is attempting to sign up again (and, like many users, ill-advisedly uses the ...


1

I would say no, do not login eventhough all the credentials are identical. Eventhough it would seem logical to login because all the credentials are identical, it will as mentioned above cause confusion. I would just say give them a notification about the username/email is already in use. If you want to login the user, I'd say work with cookies?


25

I disagree with the other answers, and say yes, it may make sense (with a couple of caveats). There is an increasing prevalence of the combined login/sign up form pattern on some sites, where the whole sign up form is simply email address and password, and all more substantive profile questions become an optional step after registration. This pattern ...


29

NO. There are chances that user might have no idea about their registration status on the site. And start a fresh registration. In such a case, best solution would be to OFFER a way to login by inline validation. Before the user reaches the password field, the validation should suggest ways to login as the email is present in database. But, since its not ...


46

So basically you want someone who signs up for a new account and enters already existing credentials, to log in as the owner of these credentials? I wouldn't recommend this: The chance that the person signing up is not the owner of the existing account may be small, it is still possible. The difference between signing up and logging in should be clear. A ...


4

I would not recommend that. Signing up screen should inform visitor that a certain email is already registered. When you inform the user about that, he/she takes a step back to remember when and what he/she did that. This helps him/her get into context about the last visit to this site. Your website should comply to user's mental model. I do not think every ...


0

No. Irrespective of the fact that you may want to use something other than the e-mail address to uniquely identify a user (such as a separate user ID), no 2 different users can have the same e-mail address. Period. If a user registers with an e-mail address that is already known by you, you may want to direct him/her to the "forgot password" ...


5

Security engineer / usable security researcher here. Most often the security advice handed out to website makers is not evidence-based, and even though we have plenty of knowledge and data about passwords, we know little about what makes them work. If you wonder why they're still around, Herley and Oorschot's 'A Research Agenda Acknowledging the Persistence ...


1

Can I make the process better? Yes. Just give them a password field: Password [ ] If they want to use a passphrase, a password, or just 12345678, let them. If you have to have some level of checking, then perhaps implement some minimum criteria, but for the most part, password requirements are usually more of a pain point than ...


3

Lets start with the essential, whatever solution you choose to go for, test, test and test again... its worth every effort! Now to the core of your question: Passphrase vs Password Passphrases are great way of dealing with forgotten passwords as they are generally "generated" from user memory and might also remind user of a specific situation or ...


1

I'm gonna answer this with some information that @Peter provided in the comments: Like he said, there is a lot of information widely available about why you should not use Password Masking and how it has a negative spin on UX. Here are some resources from people who really know their stuff in terms of UX. Jakob Nielsen has an article on why you should ...


0

Not sure if it is any good, but for it's worth, this is what I came up with. https://jsfiddle.net/qqqkzkx1/embedded/result/ If you have any scripting recommendations or constructive criticism, please post it http://codereview.stackexchange.com/questions/87980/inline-editing-for-modifying-field-that-requires-supplementary-inputs-such-as-p. Thank you


1

Prior to my mock-up of how I think this could work, I'd like to say I'm not really a fan of in-line overlaid prompts such as this. They are stylish but they have a restrictive user base (i.e. generally web/mobile confident users). Older/less confident technology users may be confused by changing elements. Furthermore, I think you should consider people who ...



Top 50 recent answers are included