New answers tagged

0

Use your scheme with invitations and links but do put the new users in a walled-garden like environment. They are associated to their corresponding admin, they may sign in and use basic functions (like sending the admin a message or related functions) but the admin has to verify the logged in user, this will be a one-more-click process for the admin, but a ...


0

Option #3, "a passive warning" would be good in that it does not get in the way of the user, however I would suggest not simply putting an easy-to-ignore text warning nearby. Put the warning where the danger is. Style the button itself: Include a warning sign icon (like this one from font awesome) Use ominous anchor text, like "Download code sample" Use ...


3

What if, similar to option 3, whenever a user first enters the download area, a modal window pops over and the background area is blurred/darkened so it is not accessible. The modal window could contain your warning message along with a prominent "I understand the risks" button which clears the warning window and grants the user full access to the download ...


0

The end user is a cyber security professional. 99% of times the end user is aware of the type of files they are about to download. I would not make their lifes harder by having them to click two times: download>continue. Idea with the checkbox not to repeat the question solves the problem of unnecessary two clicks, however you're loosing a chance to ...


7

There are two important things I could read through: 1) 99% users do not have trouble 2) Explicit warning message is needed So considering both cases, you could go with Option 4, but additionally have a check box in the modal pop-up, that could say "I am aware of this. Do not show me this warning next time" or something of the likes. A regular user could ...


0

Security Cost cutting and lack of necessity is surely part of the answer but I just wanted to add, security. With one less lock there is one less point of failure where a car thief can punch in the lock. (also mentioned in this thread on the same subject where "jcasa" points out the same thing)


1

Two-way verifications are much more secure due to using different communication channels. The first path will be better in terms of user experience and security. You need to reduce the barrier Two-way verification cycles can be embedded to sign-up process. SMS for an individual can cost money. If you make your user to pay for your SMS; they can feel that ...


1

I'm surprised that nobody has pointed out that this is wide open to a spoofing attack. Sending an SMS with a spoofed originator (the sender) is incredibly easy and costs very little to do. You can't trust that the message has come from the genuine owner of the number (or even that the number exists at all). The traditional model (where you send the user a ...


1

Sorry to use the answer function, but I don't have enough reputation to comment yet. :( I just wanted to say I really like the 4 step approach that Monomeeth suggests. I'm a huge fan of the KISS principle and this approach seems to fit. The only negative of it that I can see is if you're laying in bed in the middle of the night next to your partner and ...


0

In terms of security, both will be pretty similar. However, in terms of user friendly, I would not request my user to send a text message to my system. Not everyone has text messages in their plan, since the age of whatsapp, imessage and the like. It could possibly cost them a small amount of money and that could be a barrier. Unless of course, it costs ...


8

A good password system relies on hashing (1-way encryption) and so cannot check to see if existing passwords comply with rules about criteria (video here:https://youtu.be/yoMOAIzBSpY and here: https://youtu.be/8ZtInClXe1Q) 1) Roll out validation checks based on new criteria for any new passwords created. 2) Email all users telling them that the criteria ...


0

I would not log out users that are currently logged in. If I was visiting a site that suddenly logs me out, I would not appreciate that. You could show a prompt, but personally, I would do that at the next login attempt. I would do these things to ensure the users update their password: If you have cookies to remember me, I would set a new cookie value and ...


0

There is a lot already happening to improve this UX, of switching apps to see token value. Let me summarize: 1) A lot of apps today are able to wait and read the incoming SMS to detect the code and pre-fill it for the user. I think that is a very good way forward and more of a enhancement rather than a total new solution. It has a back compatibility that if ...


2

I have to be honest and say I have never liked the idea of verifying mobile phones as a security measure. More places are starting to use this as their sole verification method, which causes major problems for people without mobile phones as there is no way for them to create accounts with some of these providers. I do, however, think it is a perfectly valid ...


6

Both are equally good in terms of security. According to me the first senerio is good enough and adapted one. We are used to first senerio. The second senerio doesn't making much changes and unnecessarily user will confused with the new approch to do things. In terms of UX, the first senerio is much easy and user know this gonna happen. Most of the ...



Top 50 recent answers are included