Tag Info

Hot answers tagged

13

Many might think that the complementary email might be useless, but this is actually a security message. What if someone left their account logged in, and someone changed the password for them? The ACTUAL owner of the profile should be notified that it was changed. It has become a standard to make sure that users are aware of what information has been ...


5

Keep track of active reset links for a given email address. If a link is still active, and the 'forgot password'-button is clicked again, resend the active reset link. You can even warn the user that an email was already sent and that she should maybe check her spam folder. You still run into the problem that no reset link should be active for longer than ...


5

As the search results are only tied to the search term it would be natural to place a clear link/button as near to the search-box as possible, preferably inside the search-box(as done in Safari). Also I would recommend you to keep more distance between the search-box and the action buttons(preferably by putting action buttons below the table) as the action ...


4

We have spent the last months battling with what to do with email confirmation/verification - prior the user had to give all their details at sign up (way too many actually!) but couldn't actually login until they had confirmed their email address by clicking a link. We stood back and looked at why we did this - three reasons really, one being we wanted ...


3

What I've seen so far, Restore Defaults Restore Default Settings Reset App Settings Reset All Settings Followed by a confirmation dialogue informing the user that all his/her saved settings will be lost and the application will be rolled back to its original state.


3

For a cleaner look, avoid having a reset button. Hovering (although complicated) is visually more appealing. For a "null" vote, you can have a 'o' (preceding the stars) which can turn red when selected -- meaning the user has dropped his vote. o * * * * * (Many current systems do not have the provision to remove a vote; if a user doesn't like the ...


2

I think the main thing to worry about here is the familiarity of forms blanking the password field on a form validation error. Since most users aren't savvy enough to distinguish between an AJAX request and a standard one, they may think their password field not being blanked after clicking "save" and receiving an error is unusual/insecure behaviour. The ...


2

Well, this is some kind of old approach imo. A while ago username was usually used for two purposes: as identity (to log-on) and as something to display (when you post comments for instance). I believe it came from standalone apps and operation systems, where email is something secondary and username is something primary. Meanwhile it doesn't work in a web, ...


2

People would generally tend to be surprised if they didn't get a confirmation email of changing password. Not only does it serve as the early security alert option for those who may have had their account altered by others, but it also serves as a confidence booster for those who did genuinely change their password. Note that the email has to be immediate ...


2

It depends on what the risks are. As you've pointed restricting the user to only use new passwords means they have to memorise more passwords, etc. This adds a burden to the person using the system. The advantage is that it puts a limit on the period of time a broken password can be active. It also means that if an attacker succeeds in changing a ...


2

Scenario: The company db was hacked and user information was stolen. The company is asking everyone to reset their passwords asap to limit any further theft using personnel ids. In such a scenario, it is utmost important that the users DO NOT use the same password. Same situation is also faced when someone has 'hacked' into your account. If you reset ...


2

If you're fine with not having a verified communication channel with your user. Then sure. But I can't really think of an application where I wouldn't want that. Because not having that verified email means that a forgotten password is the end of the account. Further there's few things I'd allow that type of unverified user to do that I couldn't just do ...


1

Adding 0 to the stars rating is the good solution, hunch.com has implemented it in a very nice way, screenshot below, but I recommend to sign up hunch.com.


1

This is simply a tradeoff between usability and security. Think of it almost in the same way that you think of insurance. You pay a little bit regularly to covers yourself from a large loss that will typically happen infrequently (if at all). Requiring regular password changes in theory makes a system more secure. Not allowing old passwords to be reused ...


1

It does not matter which token is being used and all remaining links become invalid. This is the behavior I would like, and the email could explicitly state "this link will remain valid until [some date-time] or until your password is reset, whichever occurs first" (if the password were reset someway outside the email resets, e.g via tech support, all ...


1

All links work and he can reset his password as many times he likes. This sounds like a "user friendly" way to do things, but in reality this means anyone that gets access to their email at any point in the future (provided it's not deleted) can reset their password (and probably knows their account name from the email as well!). The same problem holds ...


1

I have no research to back it up, but I like it when the search box has a small X on the right side that clears the results. It is in use in various UIs, including the find window on browsers.



Only top voted, non community-wiki answers of a minimum length are eligible