New answers tagged

2

I have never found multi-paged registration processes to be required. Most of the time I opt for a 'progressive disclosure' model where the user is only asked for details when they are needed for a particular operation. Lets say that you want to capture the users email, name, postal address, credit card details, and date of birth. If you ask for it all up ...


1

Ask up front Think about the emotional state of a user who is saving to complete later. They are likely doing this because: They have form fatigue They have run out of time Something more important has come up In any of these scenarios, asking for log in creds when they choose to save, adds an unexpected and likely undesired step, burdening a user who ...


2

Never provide an attacker with any clue whatsoever to his only question: "What account credentials may be valid?" This is a problem comparable to the error message that one would show when a login fails. You shoudl never state things like "Wrong password" or "Wrong username". Use phrases like "Wrong credentials" or "Wrong username/password combination". ...


7

No, please don't First of all, I'd try to study and test if I need a captcha. And I mean, test it thoroughly. While Captcha are an obvious enhance in security, they have severe issues in terms of usability. see the docs below: Usability of CAPTCHAs - Or usability issues in CAPTCHA design Recent Findings On Captcha & The User Experience CAPTCHA Can ...


10

If you clear the password field when you have a faulty password, then it should clear the password field on a faulty CAPTCHA too and it should not specifically state that it was the CAPTCHA that was wrong while the rest were valid. Why? In case of using CAPTCHA — i.e. you are expecting bots to come knocking on your door and you wish to turn them away — ...


-1

As per my point of view, captcha and password fields are not related to each other. Because captcha means you are checking that details entered by human or machine(robot). First decide that what's your priority password or captcha? If you car giving constrain such like user can't login without correct captcha then there is no need to remove password field. ...



Top 50 recent answers are included