New answers tagged security
I think you should have authentication because you aren't losing anything with it there, but can lose a lot without it. UX wise, that's a good idea because it will allow users to feel safer with that functionality in place, which ultimately increases your security which also enables user trust. To implement it, it could be as simple as: download ...
In general it should improve perception of security, but user perceptions are a funny thing. Consider example 8 on these surprising AB Testing results. In this instance the security seal on the form led to a drop in signups, because the security seal icon was interpreted by some users as a sign they were about to pay for something. The moral of the ...
Here's an interesting fact about people on the net, especially towards e-commerce. Anything that looks secure gives the user confidence It was noted in user testing that if a login form, checkout process, or anything with sensitive information looked secure, it made the user feel safer to proceed. This was done user testing specifically the checkout ...
As a developer creating an application for capital markets, I do not want to verify email addresses as valid by checking against any third party email providers even if they are good ones. I dont even allow anyone to sign up on their own. An admin signs them up, gives them a username. The login page itself is also an https. This is just because all banks, ...
There are a lot of good things up here, but it misses one key point: you can't use an email address for a password reset, because it's not secure enough, and you don't use an email sign up. Those are the two key reasons why almost every online service has an email address associated. Without them, there's no reason not to use a username instead.
I can speak from the bank accounts I know in europe: You don't even need an email address to have an online banking account, as registration usually happens offline - you get Pin and everything via postal mail. Since you don't need an email to use the account, it does not make sense to use email as username.
There are a number of reasons: It prevents someone causing someone elses account to be locked maliciously (if I know your email address and you bank with Barclays I can lock you out of your account by repeatedly attempting wrong passwords). As @AlexFritz indicated it makes it harder to try hacked username and password combinations from other sites on the ...
Email is less secure than online banking (I hope) so maybe the thinking is that since people tend to use the same passwords for everything, using email instead of username for bank login would create a vulnerability in the case of email passwords leaking, the thief could go around and try that email password combination a bunch of places, and probably ...
My experience from local government, where money was involved, is that user-names provide another level of security beyond an email address. It was the generally held opinion that someone could relate an email address to an individual but a user-name could be unique to that site. It's a fairly arbitrary measure, but it's a measure.
Top 50 recent answers are included