New answers tagged

2

Always the downloads page on the official website. This is so that your users can trust you that the executable comes from a dependable source. If it's available on app stores, also add links to all the supported platforms' app stores, on the page of the app.


0

Not authorized is not the same as forbidden. I suspect that they just can't stand in for the page you are about to visit and want you to take that into account when you continue. They could have phrased it more friendly though: The content on the requested page is not under our supervision and we can't guarantee the quality that we stand for.


1

You need to take into consideration: how often users login and how likely they are to remember any credential how sensitive the information is (both financially and legally) whether federated authentication is an option or you need a specific form of id verification (e.g. legal proof of address) I suppose you are authenticating households rather than ...


2

If you're sharing the link to someone else's software, you should ask the author of the software product for guidance. Most authors would prefer you to link to a download page rather than the binary itself (usually for advertisement purposes). If the binary depends on the platform, point to the download page. In your question, the second link would be ...


1

This depends a lot on context. Is this software something that is required to complete an ongoing process? Is this software something that's not vital but good to have? Does the software require complex system setup rules? Does the software operate on it's own or does it require user intervention? There are plenty more questions like this that you need ...


-1

Wow! It sounds like you're planning to store the password for direct checking - this is such a bad idea I don't know where to start! - No secure system should store users passwords. Most modern secured system do not know what your password is: When you enter a password, the system uses a one-way mathematical operation to arrive at a new string. This new ...


-1

Good arguments above, but I guess to faster the process and since they are not much into the technology or using the machines, generate password with medium length A-Z, 0-9 without special characters and display it for them upon completion, as well as send an email with the generated password and give them link to change the password if needed.


4

The best way is to let the user set a password. Why? Most people know why all accounts are safeguarded with passwords, be it people with good technical backgrounds, or none at all. They have ATM pins, bank passwords and even employment account passwords. So they will not get confused with the request for a password and why it is needed. The user should ...


4

I think the third option is the best way to handle it if you want to split the process in two steps. You can display a message after the first step to notify the user he need to update soon the profile and set the password. Sending a password in email isn't secure and the user will have to change it immediately after logging in anyway. You can read about ...


1

There is no good way to implement a CAPTCHA. They're bad, really bad, for usability. The latest Google text CAPTCHA to be used before this picture puzzle was apparently easier to solve by bots than humans. I know I could spend dozens of tries before succeeding. Up to 40% of users allegedly failed to solve these when they were taken out (though I've lost the ...


4

Captcha is inherently not user-friendly, as it is a barrier to content that has no relevance on the user experience. Trying to roll your own captcha process is going to not achieve what you are trying to accomplish, for a few reasons: Users already have a defined mental model of what to expect when using captcha. This is due to the widespread use of ...


0

..." which is also recommended as a better solution in the accepted answer to the BBC question." Contrary to what I (and others) assumed, some studies have found passphrases aren't any better than passwords: Keith, Mark, Benjamin Shao, and Paul John Steinbart. "The usability of passphrases for authentication: An empirical field study." International ...


0

As said by anthonyryan1, it is required for American Express. So either you ask for/require this information only for American Express (which would mean you would either have to ask the user for the card type or start by letting them input the card number and then asking for the rest, or you disable the field if you see it's not required once a Non-Amex card ...


1

People don't want to make an effort creating complex passwords because they don't have one password, they have twenty or more... My answer would be very similar to one I gave here on how to engage users in adopting a password manager. You can suggest the use of a password manager tool (and ensure your site can deal with the very long passwords they ...


1

I'd suggest that one key is to show them how they can easily choose a more secure password without making it difficult to remember. I've done this with four simple questions - shown here with one set of answers. Choose some kind of critter ... Ferret Choose an unusual characteristic for a Ferret ... Slimy Choose a number ... Three Choose a colour ... ...


5

Okay, regardless of whether you're just talking to someone about it (because they've had a whinge about passwords etc) or you're trying to present a better user interface on a website or some app, I think the best approach is to just use natural language. In 2010 I facilitated a session around IT security in workplaces and the approach I came up with that ...


1

If you want to look at this from a behavioural perspective, we know that people generally need the specific type of motivation that will make them do or not do something. Generally speaking I think they fall into four categories: The carrot category: give them a sweetener to do something if they are wanting a reward for the effort - probably the best user ...


0

While you're correct that Visa and MasterCard do not validate this information, that's not true of all credit card providers. American Express actually does validate the "Name" field if you collect it as a merchant and by not collecting it you're more likely to have legitimate payments declined with this card.


0

Use your scheme with invitations and links but do put the new users in a walled-garden like environment. They are associated to their corresponding admin, they may sign in and use basic functions (like sending the admin a message or related functions) but the admin has to verify the logged in user, this will be a one-more-click process for the admin, but a ...


0

Option #3, "a passive warning" would be good in that it does not get in the way of the user, however I would suggest not simply putting an easy-to-ignore text warning nearby. Put the warning where the danger is. Style the button itself: Include a warning sign icon (like this one from font awesome) Use ominous anchor text, like "Download code sample" Use ...



Top 50 recent answers are included