2

Often due to security policies implemented in some organisations or software applications, users are required to change their password after a certain number of days.

Usually when you have been typing the same password for a period of time, having to change it and remembering that you have changed it means that you end up typing the old password by muscle memory or just bypassing short term memory.

I was wondering if anyone has seen an example of reminders that you have recently changed password to address this user behavour?

Improve this question
2
  • 4
    Changing password is common user behavior. Majority system show message; As reminder to changed password. Google do it very effectively. goo.gl/4KmfXZ
    – Andy
    Jun 27, 2017 at 6:36
  • It's often a visual help when the website detects that the entered password is an old one. I think the rational behind is to display only when it's needed.
    – asiegf
    Jun 27, 2017 at 7:26

2 Answers 2

Reset to default
2

As Andy stated, Google do it quite well, as do Facebook. So it seems like a viable option, and from a UX point of view, it's quite handy giving people a visual clue what the error is and how to correct it.

Improve this answer
1

Can't say that I have ever come across any system/software/app that reminds user of recent updation of password. Never really thought that could or should be a feature. But now that you bring it up, let's see if this can be done.

My solution: Inform the user about the expiry date of their password

In most systems that ask the user to change their passwords as a regulation, there's fixed lifetime of each password (like, it is 60 days in my firm's network). Showing a message like, "You recently changed your password" or "You seem to be entering an old password" might have problems like:

  • How to determine how many days can be considered "recent"?
  • Could this lead to security risks like leak of password patterns (as people tend to use a pattern when they have to change it regularly so as to keep track)?

I would think having a message like, "Your password expires in 17 days" would keep the user aware of that deadline and also make them realize if they have changed it recently.

PS: I still think informing user about password changes before logging in is a MAJOR security risk. My answer is limited to the OP's situation

Improve this answer
4
  • "informing user about password changes before logging in is a MAJOR security risk" - could you briefly elaborate on that, please?
    – O. R. Mapper
    Jun 27, 2017 at 8:26
  • In order for the system to recognize the user, the username needs to be entered as a Step 1 in such cases (In Outlook webapp, you enter the email id and the system verifies that before allowing you to enter the password). I could be a guest user/bot and I might be able to read and track user behavior and patterns. In case of office networks, the usernames are tied to the employee and would be available to all via address books. I don't think I'd be comfortable if every user in the network can figure out when I changed my password or what my old password was just by entering my username
    – Shreyas Tripathy
    Jun 27, 2017 at 9:33
  • 1
    @ShreyasTripathy you're making a massive jump from knowing when I changed my password to knowing what my password was. How do you actually propose someone make that jump?
    – Darren H
    Jul 31, 2017 at 13:19
  • I remember getting goose bumps when I try to log in to some portal and the answer came: "you just type your old password, you recently change your password". I don't want sites to keep my old passwords. I think we all don't feel ok with that, right? Messages like that should definitely go before you start typing. If massage is so clearly automatic it is even better. It keeps you sure that nobody is storing your passwords.
    – Ada
    Nov 24, 2017 at 12:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.