126 reputation
3
bio website
location Sweden
age 38
visits member for 3 years, 2 months
seen Feb 14 at 9:14

Apr
8
awarded  Popular Question
Sep
13
comment How do I best tell a user that his/her account will be locked if they enter the wrong credentials too many times?
Hmm. Some good points here. I have to talk to my team some more. Perhaps we are making a mistake introducing this. The thing is, we have had people trying to crack passwords, but not real cracker attacks. Just students trying to guess their teachers passwords. So something needs to be done.
Sep
11
comment How do I best tell a user that his/her account will be locked if they enter the wrong credentials too many times?
I should add that we have decided on only presenting the users with the "your account has been temporarily locked" information once they enter their correct username/password. So, a hacker who makes 100 attempts to guess a password will still only see the generic "username/password error" message even though the account was locked on the 5th attempt. Does this make sense?
Sep
11
comment How do I best tell a user that his/her account will be locked if they enter the wrong credentials too many times?
Nope. :) But I cannot really think of a way to prevent that. I am open for ideas here. The extra security is something that we must have. This is an e-learning product and we have had situations where students have been able to guess teachers passwords after a number of tries. But you are absolutely right, this will enable evil students to deliberately lock teacher accounts if they figure out that this functionality is in place.
Sep
11
comment How do I best tell a user that his/her account will be locked if they enter the wrong credentials too many times?
... Our clients are responsible for induction training etc. and they never do a very good job with it. What I am thinking is that the level of security can be raised according to the client's needs by setting the lock-out time to, say, 24 hours. They could still call support and have them unlock the account of course. Do you not think that would discourage most hackers/crackers enough to make them move on to easier targets?
Sep
11
comment How do I best tell a user that his/her account will be locked if they enter the wrong credentials too many times?
"never give a hint about which token is wrong". Good point. We only tell the user that the username or the password was wrong, so that is already covered. And I get the point about not divulging anything about the process or how long the account will be locked, but I just know that if we don't tell them, tech support will be overloaded with calls about how to reactivate accounts that may already have been activated. You see, this is a product that we sell. ...
Sep
11
awarded  Student
Sep
11
comment How do I best tell a user that his/her account will be locked if they enter the wrong credentials too many times?
Yes, there is a password recovery feature.
Sep
11
comment How do I best tell a user that his/her account will be locked if they enter the wrong credentials too many times?
Yes, there is a password recovery feature. I will not go into detail about that here, but Nicks suggestion is a good one.
Sep
11
asked How do I best tell a user that his/her account will be locked if they enter the wrong credentials too many times?
Mar
23
comment How to use many sliders with lengthy textual descriptions
+1 for suggesting a matrix instead of sliders. Better UX in my opinion. Much less "fiddly" for the user and far more accessible for disabled users (which has to make sense in this case with a health related web site) My only suggestion would be to use radio buttons instead of checkboxes so that it is clear that only one value can be selected for each row.
Mar
9
awarded  Supporter