Tag Info

Hot answers tagged

153

One reason why this might not be a good idea is that you would have to enforce unique passwords. This does not seem like a big issue to user experience at first, but from a security point of view, this is critical, here is why: Enforcing unique passwords means that when a user picks a password there is a chance they accidentally (or with malicious intent) ...


92

No - It is a bad idea: a. Storing password as plain text instead of hashed with an individual salt. More details here and here. b. Emailing a password, as: b.1. emails are transmitted unencrypted over the Internet. More details here and here. b.2. Users could open up the email and accidently expose their plain text password to someone standing next to ...


85

A better modification of such a statment which I see being used is: 'A company_name employee will never ask for your password' This message alerts the user that if the person is asking for a password, there is something fishy and he should alert the concerned authorities immediately. With all the live chat functionalities that most industries are ...


79

If a user doesn't have permission to access a particular item of content, I would suggest not displaying it at all. If the user needs to know that content they don't have access to exists - show them the content in a different form and provide them with a way of enquiring about how to gain access if necessary. Eg. as a content list (rather than semi ...


62

You're looking at the problem from the wrong angle. A user could also open a different browser, or use a second device, which means you can't rely on the idea of opening tabs(and preventing it), nor on IP address. Your solution needs to be server-side. Signing them out would just annoy them. Either make it so your website show them the same game no matter ...


61

I'd like to take @lazer's suggestion a step further. Why not add a small padlock icon after each of the links the user does not have permission to? Then, if the user would hover the link, I would show them a tooltip explaining that they don't have permission to view the page contents.


48

It's not uncommon for sites to display password strength (weak medium strong verystrong) next to the password field. What if you did something like this - but instead display "time to crack", an (arbitrary) estimated length of time for the password to be cracked, together with some commentary. [password ] Cracked in: 1 minute ...


45

Most security breaches are from social engineering, and so telling someone that they should never under any circumstances give anyone their password is an attempt to increase security. I would suggest a statement more like: If anyone asks you for your password, you should assume they are a criminal and report it immediately! Idea provided by @Kaz As ...


45

Researchers from Carnegie Mellon University recently (2012) looked at password strength meters and its impact on password creation. The paper "How does your password measure up? The effect of strength meters on password creation" has all the details, but the abstract summarises their findings nicely (emphasis is mine): We present a 2,931-subject study of ...


43

On any site is is not ideal to break a user's expectations. As a user expects to be able to navigate the internet with tabs in their browser, you shouldn't break it.


40

If you choose to have a password only log in, you will run into many problems. Security If you only require a password, you have no way of knowing who it is that you are logging in unless you enforce unique passwords. In that case, if I were to sign up and tried to use a common password (say "Password") and your system told me that it was not allowed, ...


34

You have to go with the first option (stating that the "username or password is invalid"), and this has nothing to do with security. Let's say that I usually use JohnGB as my username, but on your service someone else has that username, so I use JohnGB123 instead. Say I've then forgotten my username and I enter JohnGB as my username, but use my correct ...


34

There's nothing MORE ANNOYING than dictating me (a user) what password I should choose. I good example of such annoyance is this site's log-in system. Although there are benefits of automatically preventing passwords such as "123456" and "password", here's my reasons against forcing super strong passwords: Unless your system is something that a user has ...


33

Passwords should not be stored in plain text anywhere including the users email inbox. What happens if his email is compromised or if he's entered the wrong email address and someone else receives the password?


32

No. While it seems to be annoying, I see four problems with not having to enter the login information again: I will remember my new password better if I have to type it once more. (I keep forgetting my new e-banking password because I don't have to re-enter it, and I of course don't store it in the browser.) If I want to store the password, the browser PW ...


32

Password strength indicator does not, per se, guarantee stronger passwords - from a pure UX perspective the more complex your requirements are the more likely people are to click away, to use an existing password or to write it down hence making it harder for a human to remember but, all too often, only marginally more difficult for a computer to crack. ...


32

In general it should improve perception of security, but user perceptions are a funny thing. Consider example 8 on these surprising AB Testing results. In this instance the security seal on the form led to a drop in signups, because the security seal icon was interpreted by some users as a sign they were about to pay for something. The moral of the ...


30

In my opinion: YES. The authentication has been done when the password is reset, so the user could be logged in. And it annoys the hell out of me when after password reset I'm not logged in. I can't think of any case I wouldn't want to be logged in after resetting password, why would I even ask for password reset if I don't want to log in?


29

Cutting it down to a single step makes the process simpler and better fits existing conventions, so it's probably superior from a UX perspective. Each additional step you introduce is more work for the user. Add in the potential for users waiting between page loads (especially on mobile) and you're really just adding an additional inconvenient step in their ...


26

From a historical viewpoint, I suspect the reason is simply "because someone thought it would be a good idea". In fact, I did a little bit of digging. The padlock icon for HTTPS links was first introduced to MediaWiki in 2004 as part of the then-new MonoBook skin by Gabriel Wicke. Specifically, it first appears (along with a generic link icon and special ...


25

There are a number of reasons: It prevents someone causing someone elses account to be locked maliciously (if I know your email address and you bank with Barclays I can lock you out of your account by repeatedly attempting wrong passwords). As @AlexFritz indicated it makes it harder to try hacked username and password combinations from other sites on the ...


23

I worked on a very similar project to yours where users could only view the content based upon their access permissions. Though the initial reaction from the stakeholders was to just show content, to which the users had access, there was also feedback that users might have wanted access to specific content. Thus, hiding unauthorized content would have lead ...


22

A reason that just providing passwords could be problematic is in system administration. By providing only passwords you are making it difficult for the administrator to get a handle on the account. Thus while each account may have an account number, the admin won't be able to easily relate that to a user. e.g. User: "I have a problem with my account" ...


22

Every constraint you add to a password pattern, the more cognitive load you add to a user. And constrains can be good to make a password secure. But how secure is a password that user constantly forget and as a consequence hit the “forgot password” workflow yet again. Further you minimize the option for users to use there already memorized secure password on ...


22

You shouldn't enforce the characters in passwords. Instead you should encourage passphrases which although longer are more secure and easier to remember. Instead of trying to explain this, I will let XKCD do it for me:


21

Number 1 is one of my pet peeves... especially because I tend to immediately confirm my email, so the flow for me is fill out form > check email/click confirm > return to site as authenticated user. If, after doing that, I have to log in again, it drives me up the wall! At the very least, allow your users who are confirming their email address in the same ...


19

Workflow-wise, 1 step is a no-brainer. It's three fields and there's no reason to separate them. You can also nicely inline validate all 3 fields at once; what if my passwords don't match on the second screen in 2 step? Is my old password still valid? If not, that's a pain in the butt. If so, that's a potential security risk! Actually a two step seems ...


19

High password entropy protects against brute forcing passwords. It does not protect against any other attack against passwords. Your first task should be to ensure that the passwords will not get stolen from your servers and that you have proper timeouts. With regard to password policies my stance is as follows: Do not store passwords in plain text. If you ...


16

While some internet marketeers have stated that the appearance of being more secure can have a measurable effect on sale completions, I doubt that this would matter for sites that aren't directly selling something. You also have to keep in mind that HTTPS connections are slower than HTTP, and so people will likely find your site slower. Amazon found that ...


16

There are couple of user bases to consider here. The hacker who is genuinely trying to hack your site by doing some kind of script injection or by trying to make your site run some malicious JavaScript The clueless newbie who is not sure what goes into a form or who just migrated from an old system where he used to enter search queries to retrieve data ...



Only top voted, non community-wiki answers of a minimum length are eligible