New answers tagged

0

There's a Wordpress plugin that will let you do this: https://wordpress.org/plugins/hideshowpassword/ And a Codepen example where you can see the functionality: http://codepen.io/kylephillips/pen/GgJbKq It's hard to find a real life example because mostly they don't exist. Even the guy who gave the WP plugin above a 5-star rating doesn't use it on his ...


3

Follow these 2 steps 1) When user logs in first with your auto-generated password, ask them to create your own password with which they will login next time. 2) When user make a purchase or do any transcation on your wallet (store credit feature) ask for a OTP. Tell the user that they can opt out of this OTP but it is not recommended. This password ...


1

There is an update to the blog post now with suggestions. Friction problems I use a hotmail account for all my random logins that I don't log into very often - so I would have to switch to another tab, login to my email, wait for the email - it can be 10-30s, switch tabs back to login to their website. Users with password managers, who can normally login ...


0

It's interesting thinking - but users forgetting which email address they used is a big part of the login problem in the first place. As a user of password managers, I agree I would feel penalised with the reset every time approach. The other issue is that emails get lost/spammed filtered and low-tech users have enough trouble with email as it is - ...


0

Unless you're really, really concerned about the authenticity of users' email addresses - skip the 2nd step. If, for some reason, you want users to sign up with their real identities - again skip the 2nd step and use Facebook authentication or something similar instead.


0

What about the user fills the registration inputs, clicks the Send or Register button and a message shows saying You are going to create a user with email example@example.com + a button saying Confirm as a last step for the registration? User would read the email again and confirm, instead of having to write twice their email or open their email app.


1

The only approach that is valid if you must assume that you will be observed is the use of One-Time Passwords. These are designed for such situations. Put another way, you need a factor of authentication that expires as soon as it is used. As a side-note, this question would be more suitable for the Security StackExchange site.


0

EDIT: oops, I misunderstood the question. You don't want to 'disable' Caps Lock because how exactly would you communicate to users that this mode is unachievable? Some users may not know how to use Shift to temporarily enforce uppercase, and may not be able to type their password anymore. Besides, it seems unintuitive that a functionality of your keyboard ...


3

The core reason that you don't want to do this is because, as a general rule, any time you override the standard behavior of a users device, you open yourself up to a bad user experience . . . particularly if you do it without any kind of notification. Overall, within your application, standard control behaviors should continue to behave the way that the ...


0

It's a good practice because any good UI should tell you of its current state; It's not so much of a warning, more of a notification. Accepting multiple variants of the password is really bad; you're essentially reducing the complexity of the password. By disabling caps lock you're taking control away from the user and the only reason seems to be just to ...



Top 50 recent answers are included