35

From a Ux standpoint, what is the best practice around messaging when a banned user/customer/member attempts to log in? I'm asking for a forum project I am working on, but also looking for guidance which would apply to any scenario where a user can register/sign-up, etc, then be banned/locked, etc.

I am still working out all of the use cases and flow, but what we know is that there can be a banned user, and there exists some login functionality and a reset password functionality. The need is to "handle" cases where a banned user attempts to use any of those functionalities. I guess that is the broader question - what is the best way to handle this from a UX perspective.

Specifically looking at messaging for (a) when the banned user tries to log in, and (b) when the banned user tries to reset their password.

Seems there are three options, going from more specific down to more generic:

  1. Message is shown stating the user is banned and can not be logged in
  2. Message is shown stating the user can not be logged in, and not state why
  3. No message shown.

The "community building" aspect of the question is here: https://communitybuilding.stackexchange.com/questions/1377/banned-user-tries-to-log-in-show-a-banned-message-or-a-generic-cant-log-you

Improve this question
10
  • 27
    Why prevent login? Might it be better instead to allow login, and then prevent all actions by that logged-in user? (What's the difference? Well, for one thing, if you let them log in, then their browser can remember the logged-in state for (A) when their ban expires and (B) pursuing any appeal process.)
    – Dan Henderson
    Commented Nov 5, 2015 at 19:21
  • See also Community Building SE.
    – gerrit
    Commented Nov 6, 2015 at 11:35
  • 4
    Why are you spending this much time and thought on banned users? This time should be devoted to good users.
    – blankip
    Commented Nov 6, 2015 at 18:57
  • 2
    @blankip Because often times, banned users are good users who are upset about something. Handling this correctly can be the difference between getting the behavior/issue corrected and continuing a good relationship or turning users away blindly and never understanding what may have gone wrong.
    – SnakeDoc
    Commented Nov 6, 2015 at 19:50
  • @SnakeDoc - Well that is the issue. Banned means banned. You can't go in there - for a long long long time - or forever. You are talking about the word "suspended". Yes I can see the issue needing to deal with suspended users but the wording on the question needs to change.
    – blankip
    Commented Nov 6, 2015 at 20:01

9 Answers 9

Reset to default
39

From a security perspective, make sure you're only showing messages if the user has provided their password, even if they're banned.

I would recommend a ban notifcation (including time), when the user attempts login, show them the reason they were banned and the length of time they were banned for.

if there is an appeals process, this would also be the place to put it.

I have no hard facts to support this, but I've seen it done this way on countless gaming sites/platforms.

Improve this answer
4
  • 19
    To add to user5482's answer. You should also give the user a way of contacting you for questions etc regarding the matter. You'll be surprised on how many occasions people forget to sign out on public computers...
    – Johan Svensson
    Commented Nov 5, 2015 at 15:51
  • 2
    @user5482, Not "security", but privacy.
    – Pacerier
    Commented Nov 8, 2015 at 1:40
  • 1
    @Pacerier why is that not also about security?
    – Mario Trucco
    Commented Nov 9, 2015 at 9:34
  • @MarioTrucco, Because usernames do not contain (are not meant to contain) secure information. This is comparable to transparent crystallographic systems whereby the security depends entirely on the password and the password alone. It's a security risk only if the username is leaky, for example usernames like PwdIsTheNameOfAFruit or PwdIsMyUsername.
    – Pacerier
    Commented Nov 13, 2015 at 12:02
18

You should always show a message. User needs to have some sort of control, even if it is a simple you are temporarily banned and showing of the timer ( duration of the ban ) enter image description here

I would also suggest adding a button " contact us" where that user can dispute if needed, maybe they feel it was unfair or whatever...basically give them an option to be heard.

Improve this answer
11
  • 20
    @blankip Of course "temporarily banned" is English. "Suspended" can mean the same thing as "temporarily banned."
    – Justin
    Commented Nov 6, 2015 at 20:03
  • 1
    @Justin - Part of UX is writing in an understood form of English. I am sorry that you don't understand what the word "banned" means. But my comment is correct. It would be on par with saying "Temporary Life Sentence"... huh? "Temporarily Suspended" actually makes sense and is proper English. What we have here is an internet society that passes words back and forth without understanding their meaning and then forms their own submeaning that in reality are fascicle. The word banned comes from bannish which was a type of excommunication... cont...
    – blankip
    Commented Nov 6, 2015 at 20:10
  • 4
    That is part of the definition. That is what I would expect a non-english speaker to take from the word or someone with little education. Cuba banned the US from doing things - it was a permanent action that was carried out over a long long period of time. Also the subtlety here is that Cuba never intended to lift the ban. If they were banning the US from doing something for 5 years the word would be suspended. But since the action was indefinite it was "ban".
    – blankip
    Commented Nov 6, 2015 at 20:26
  • 13
    @blankip: Nonsense. I don't know where you got the idea that a "ban" has to be permanent. Maybe you should try looking it up?
    – ruakh
    Commented Nov 7, 2015 at 0:26
  • 8
    @blankip You appear to be incorrect. According to Merriam Webster, the origin of the word ban is "Middle English bannen to summon, curse, from Old English bannan to summon;" It does not come from bannish. Furthermore, neither ban nor banish mean something permanent. Ban is "to prohibit especially by legal means; also : to prohibit the use, performance, or distribution of" and banish is "to require by authority to leave a country." Both of these could be temporary. Definitions from Merriam Webster.
    – Patrick
    Commented Nov 8, 2015 at 5:32
14

Unless you're willing to fully Hellban them, show them the reason they can't log on.

A generic error message would just cause them to seek support.

Improve this answer
2
  • 1
    Hellban is very ineffective. A prominent example is on news.ycominator.com - With a hellban, the user often doesn't even know they were banned or did anything to get them into trouble. This leads to the behavior continuing, up until the user realizes what has happened, after-which it's likely to cause even more bad behavior as a reaction to this passive aggressive nature. Just let users know they were banned and the reason. Let them open a dialog if they feel it wasn't fair. But be clear why and for how long.
    – SnakeDoc
    Commented Nov 6, 2015 at 19:45
  • 1
    I'd also have concerns about the legality of a "hellban". In the Craigslist example given on that Wikipedia article, a user submits an advert, is informed that it has been posted, and then has future page requests forged to trick him into continuing to believe his advert is posted. Who is liable for his loss of revenue resulting from the (deliberately) missing advert? It could even be viewed as fraud. This citation makes a mention of the issue.
    – JBentley
    Commented Nov 7, 2015 at 16:48
6

Well, how it's done there, on Stack Exchange?

If you're suspended, you still can log in and log out when you wish, though you can't do anything until your suspension is over - and, in most cases, the message in the profile of the banned user provides a reason for them being banned, though you don't get any message when you're logged in, except the rep in top bar being fixed at 1.

In another case on Stack Exchange, when you're banned from using a particular stack and had you account deleted, surprisingly, you can still create an account there, linked to other accounts on the network, but you become automatically suspended.

So, why restrict logging in at all? The Stack Exchange provides quite a good practice.

Improve this answer
13
  • 9
    It is easier (from a design perspective) to assume that anyone who can log in can also use the basic functionality of the app. By preventing logging in, you don't have to check everywhere for someone being banned. Not saying I support that thought process, just saying that's a model that some people use when designing their app.
    – corsiKa
    Commented Nov 5, 2015 at 20:29
  • @corsiKa In the context of a forum, there is typically some kind of tiered privilege system. Site admin, moderator, confirmed/unconfirmed email address, etc. So unless the forum is extremely basic, there has to be a differentiation between different logins and what they are allowed to do. Since you have that already, it isn't unreasonable to use that system to deal with banned users, too. It has the added benefit of taking care of users who were already logged in at the time of being banned, which you'd have to address separately in the "all logins can do anything" paradigm.
    – JBentley
    Commented Nov 7, 2015 at 16:55
  • Sure, in the context of a forum. There are many types of apps that work absolutely nothing like forums. Most mobile apps, for example.
    – corsiKa
    Commented Nov 7, 2015 at 17:10
  • @corsiKa The OP 's question is about a forum specifically, as well as the general case.
    – JBentley
    Commented Nov 7, 2015 at 17:11
  • 1
    My comment was not about the question. If I wanted to comment on the question, I would have commented on the question. My comment was on nicael's answer, where he says "So, why restrict logging in at all?" and my comment was a rebuttal to that rhetorical question. I don't see where the confusion lies...
    – corsiKa
    Commented Nov 7, 2015 at 18:49
2

Denying Login without a ban message has a tendency of making the user try and fix the problem... which can increase the workload on your support staff, and can create confusing activity logs that are hard to tell from an attempt at ban evasion/hacking, in turn making it more difficult to reevaluate the ban at a future point in time.

Improve this answer
1

Alternatively, you can use a "Login Failed" dialog box to tell the user 1) that they can't be logged in, and 2) why they can't be logged in.

This might help you keep your code shorter (since you could, say, create a loginFailed method that accepts a "reason" as an argument)

Improve this answer
1

  1. Make sure the user enters right password before displaying any message.

  2. Display a simple message noting why cant he login (here, he/she is banned). Also if possible display the reason and time remaining (if temp ban) if possible.

  3. Provide quick links to help, any related page and contact page if the user wants to contact the support regarding the ban.

Improve this answer
0

Good UX is to let them log in, and then once they're in inform them of their ban/suspension, and the reason for it (broadly, you may or may not wish to go into more detail than some broad categories that are defined under a ToS)

Improve this answer
-1

I think from a UX perspective you need to write in correct English usage.

The word Suspend is when you will take something away from someone over a given amount of time.

The word Ban or Banish is when a user cannot go to your site ever again or indefinitely.

If you plan on putting a timer or time frame around a punishment quit using the wrong word. The word you need to use is Suspend.

Merriam-Webster Examples

Examples of BAN

The school banned that book for many years. The city has banned smoking in all public buildings. The drug was banned a decade ago. The use of cell phones is banned in the restaurant.

Oxford Dictionary Examples

Part of his bail condition bans him from the Hoover Drive area. To ban him presumably would be discrimination against people with bent arms. Magistrates issued the ASBO which bans him from parts of Penhill estate and includes a curfew after hearing Liam led a gang of louts who terrorised residents.

Improve this answer
5
  • 5
    Being for an indefinite period of time is not part of the definition of the word ban. It is defined as a verb, that means to officially or legally prohibit. One example usage I found from an authoritative source (Google) is, "he was banned from driving for a year." And in fact, it is quite common for bans to be lifted.
    – Octopus
    Commented Nov 6, 2015 at 21:03
  • 2
    I'm not convinced. All of your examples can be lifted tomorrow.
    – Octopus
    Commented Nov 6, 2015 at 21:12
  • 3
    The word "ban" makes no implications about its duration. The word "suspend" implies something temporary. So "suspended" and "temporarily banned" communicate a similar message, while "temporarily suspended" still makes sense but is redundant. You chose an odd point to nitpick.
    – Brian Mortenson
    Commented Nov 6, 2015 at 22:09
  • Comments are not for extended discussion; this conversation has been moved to chat.
    – Benny Skogberg
    Commented Nov 8, 2015 at 5:06
  • @BennySkogberg My comment was unrelated to any comment before it, and I feel a relevant one, as this answer is based on a misunderstanding of the question, so any debate over what the correct usage of the word ban should be, is actually irrelevant.
    – JBentley
    Commented Nov 8, 2015 at 18:34

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.