Tag Info

New answers tagged

0

Yes, unfortunatelly, the restrictions on characters the user can use in the password have sense from the UX perspective. If you're operating a worldwide service, you'd like your users to be able to log from all places of the world. If it's the case, you must take into account, that unfortunatelly, the keyboards are not standarized. Event the layout of the ...


1

Sending a link is a way more better because: Sending a password in an email reduces trust. It is hard for the user to remember it (mostly it will be a combination of some letters/numbers/special-characters, producing a word that makes nosense) Fewer steps by far (which is a lot better on mobile): 1- click link --> write new password .. VS .. ...


0

A few guide lines: Let user enter any character in the ASCII range of 32 (space) to 126 (~) - these should be the same in any character code. Limiting your users to less characters will only frustrate them and force them to choose less secure or harder for them to remember passwords. Characters bellow ASCII 32 (and ASCII 127 = Delete) have specially ...


0

What if it takes two weeks to get the password reset by a letter being sent to my home address and I can’t access my bank on holiday due to their being a character in my password that I can’t type on my iPhone. Will I blame the bank, will I consider changing banks…… What if my back decides at some later stage they wish to use drop down lists to input a ...


2

One problem that I've seen with non-ASCII passwords is that some systems deal with characters and others deal with encoding-specific code points. The "א" character might be represented in different ways depending on encoding, and sometimes the same character may be represented in any of multiple ways ("é" could equally be U00E9 or U0065 U0301). Consider the ...


0

Authentication and security are critical. A security breach will kill you. Do you have any idea what goes on between a keyboard and server? You have normalization, encoding, ambiguities in Unicode, serialization, NAT, man-in-the-middle, and other measures. That is a secure end-to-end transaction that is used for the entire session. Bad guys want to take ...


2

It depends. If you've got reasonably strong control over the password input mechanism (keyboard layouts, software stacks, etc.), then letting users freely input anything they want is a good idea, because it maximizes the available password space. Someone attacking an English-language site probably won't try even obvious things like "كلمة المرور" (which ...


2

If you're designing for both desktop and mobile (ha! Who isn't now?) then it's a reset link is better than a temporary password. Why? It's difficult to copy and paste a password on a mobile device It's difficult to remember the nuances of a strong temporary password in between switching browser tabs on a mobile People are unlikely to change their temporary ...


3

It can make sense from a usability and support perspective. If the character isn't possible to type on a keyboard/phone without using alt codes or copy-pasting. Keep in mind that the most active internet enabled devices have touch screens. Your user could create the account from their laptop, then try to access the account with their phone, which isn't ...


24

If a site requires that passwords only contain certain character codes, then a user will be able to enter the password into almost any device which is capable of producing those characters. If the password contains character codes which may be entered on some devices but not on others, then a user who creates a password on a device which could enter the ...


14

I would like to add to DaveAlger's point. I, like many people, create algorithms in order to better remember passwords. I've spoken to many people (in an informal manner) about passwords and I have heard a lot of objections why can't I use a part of my email or my username in my password? why is there a character limit? (affects my algorithm) why can't I ...


73

If the user can type it then it should be allowed in their password. Telling someone what they can and can't use in their password always feels wrong to the user. Passwords are currently the most universal way to authenticate. Preventing users from entering anything is, in essence, telling them who they can or can't be. 1. Any printable character that a ...


4

For a website with customers, the answer is always no. This has nothing to do with security. This is because every six months you will lose a significant percentage of users who just can't be bothered to deal with the hassle of making up a new password, recording it somewhere, etc. Forced password changes are acceptable for employees and other captive ...


7

Sending a password at any time for any reason is bad UX. This applies equally to email and sms text messages. Even if the password is temporary it can lower the credibility of your brand. Building a relationship of trust is one of the most important things we do and emailing passwords always feels wrong. When sending a reset link it is also important to ...


11

Usability Implications A link is much more accessible. I can get to a link via click, tap, or with the keyboard easily; and in a confined device like a smart phone the process of opening the site in question is much smoother and easy. If I have to select, copy and paste a password from an email I need to be a little more dextrous, especially on fiddly ...


2

I find what happens when you send a temporary password, the user never goes back to change it and it's usually too difficult to remember. So what ends up happening is that the "forget password" link is pretty much used every time the user logs in. The goal really is to get them to reset their password to something that they will remember so best to be ...


2

Should passwords expire? I have a 2-part answer because this deals with User Experience and Security, but first things first : The answer is, yes! I'll do the User Experience side of things first since that's the site we are on. This has been demonstrated by a very popular webcomic by xkcd everyone will probably recognize: Now, let's test correct ...


1

I am not a security expert, but I agree with the majority of the answers that say you should not force users to periodically change their passwords. As noted above, all it does is make it more difficult for the user. This is especially true when there are very strict password requirements. Passwords are not effective security against many types of attacks. ...


0

This is difficult to test because there is very little information you can use to tell whether the users coming into your website are using strong passwords already or not. One way I can think of at least trying to work out the potential behaviour is if you can measure the amount of time people spend on the 'enter password' field before they click submit, ...


0

Anecdotally, I personally use the password requirements listed to generate the strongest possible password with my password manager. I find these very useful, and they immediately tell me if I need to turn off special characters or if I get to leave them on, if I need to reduce the length of my password or if I get to keep it long, etc. As an addendum to ...


32

It's better to send the reset link for 3 reasons: Users don't need to remember a temporary password and they don't experience copy/paste issues. Most users don't remember their password because they haven't logged-in for a while, so usually don't remember how to change their password. It requires less activity.


2

Well, it's a bit of a "dirty" manipulation that could direct a user's potential dissatisfaction at himself rather than at the system :). A user arrives at page, creates an invalid password, gets an error message that says "The password must be over 8 chars". He looks for the password rules on the page. If he doesn't find them, he becomes angry with the ...


23

The quick answer: Amazon, Google and my bank don't make me change my password every six months, or indeed ever. What do you do that requires more security* than they do? Let's hope for your users' sake that that's a persuasive argument**, and you decide not to do that. The supplementary discussion point is: why do you need to store their password? Could you ...


2

In a financial domain, yes of course passwords should expire every n months. Protecting user's accounts which hold information that valuable should certainly have these kinds of measures (and more) in place. Choosing the security for your web app totally relies on what you're trying to protect. There is a sacrifice to be made both ways, but how much effort ...


7

It depends. What does your site do? What are the real consequences of a compromised account? Annoyance or stolen identity? Outsource. Do you have any good reason not to punt and let OpenID, Google, Facebook, Twitter, and Yahoo handle user identity and authentication? Security has costs. Weigh them. Honestly, why don't you require your users to login via ...


9

Accepted wisdom among security experts is that password expiration/forced changes do not, in general increase security, and often decrease it. Frequent changes do not make the password harder to guess, they do encourage unsafe actions by users (such as writing down passwords or using easy-to-guess patterns to generate them), and they only provides a benefit ...


33

No. All you're doing is pushing the security requirement into the domain of the user when really it's your concern if the data you are protecting is serious. In this case it doesn't matter what you do with passwords, you must employ secondary measures, such as two-step verification (GMail, Github), session deletion (GMail, Github, Facebook), unusual account ...


9

No, changing passwords every six months won't make the accounts more secure. You still use the same password rules (a Capital letter, a number, a symbol, a gang sign, a hieroglyph and the blood of a virgin). In fact if you require a change, the more likely that the user will write it down in an unsecured way. More important than changing passwords on one ...


4

My bank account password doesn't expire as far as I know so from a UX perspective you are in one of the following situations: You do not trust your users to keep their password secure They write it down on their power tools or brag to their friends about how much they love Ovaltine You do not have the proper infrastructure setup to handle intrusion ...


2

We use passwords that don't expire every day now - they're called finger prints. What makes them work is dual or even tri factor authentication (must have a pin, must have the activated smartphone present). Granted, the problem is that this requires a blue collar audience to have smartphones, and you can't always rely on that. How sensitive is your data? ...


4

The password expiration is a constraint for users. Therefore it should make sense for users; otherwise it will produce a bad experience. So I think a key question is: how important is it for your users to secure their access to your web app? If you provide financial transactions or just content to read, it won't be the same....


2

Yes, in a perfect world passwords should expire and users should invent and memorize new ones. Why? Security reasons only. Expiration makes sure password changes periodically, and that prevents someone using hacked/leaked/stolen account credentials. It is good for user identity verification and authentication (low level, not real time). Password ...


93

A compromise is that when a user returns to the site after 6 months (or whatever period) then you might helpfully recommend that they think about changing their password - along with a link to why this can be a good thing for them. This also allows you to put in a framework where you might want to bring forward the date at which this happens to a specific ...



Top 50 recent answers are included