I'm looking for help around the best practice for validating identity within an update security details flow.

I am working on the sign-up, login, and updating process for a new web based financial application.

Login is via the usual email/password combo with 2FA via sms after successful password validation.

All security/login screens will be held on IdentityServer, while the application will be on our own servers, this means that accessing the update components must be shown via a new window - this will be chromeless and visually look to be part of the originating site.

As part of security we also request a 'security question', used for when the client phones up, which means we have the following data for security/login.

  1. email address (not updatable online)
  2. Password (updatable online)
  3. Telephone number (updatable online)
  4. Security Question (updatable online)

(only one of the security details may be changed in 24hrs)

When the client is logged in to the application they will be able to update password, telephone, and their security question from within the app. As this data will be accessed from the "my account" section which will show (and potentially allow updating of) other non-security related data (address, etc.). There is a requirement to re-authenticate the client before they can change any of the security data via re-entering the password.

Update password will be presented a common pattern - enter existing and then new password. Change Password For updating mobile phone and security question the password request is proposed to be a first step before accessing the upate component. update telephone, enter password

There has been a request from the business to duplicate the password functionality (enter password and update compmnent on the same screen) for telephone and security question.

My initial response is to say no as this seems to be mixing the authorisation and update tasks, potentially confusing the client. However, rather than just go with my gut reaction I hope to get some more concrete guidance on the issue.

  • By "duplicate the password functionality" do you mean you want a pop-up/page where they enter both the new value of phone-number/question and the confirmatory password in one go (as opposed to, as you've presumably currently got it, having to enter the confirmatory password as a separate step to entering the new phone-number/question)? If so, then it would seem to be no more "mixing the authorisation and update tasks" than entering the old and new passwords on the same screen (by that logic, you'd ask for the current password first, then ask for the new one in another screen.
    – TripeHound
    Commented Jul 12, 2017 at 11:29
  • Yes, exactly, showing the password (authorise) and the update telephone/question (update) in the same panel. For password this is an established pattern, however my concern is that for non-password data this is not a pattern that is in common usage. I may be wrong, but in my experience I have always been asked to authorise before, (or in the case of banking after I have requested a new payment) never at the same time.
    – steviefish
    Commented Jul 12, 2017 at 12:56
  • It's an interesting conundrum: "be consistent" says both should ask together, or both should ask separately, despite "common usage" that asks together for passwords and separately for most other changes. Like you, I can't remember a case where authorisation was asked at the same time as the change/payment/etc. details were entered. Possibly because there's potentially more verification needed (esp. for payments) and they only ask for authorisation once the details are verified.
    – TripeHound
    Commented Jul 12, 2017 at 13:02

1 Answer 1


Given that I got the story right..
User: I want to change the security Question and Answer
Computer: I provide you with a visible change link
User: I expect that by clicking on this link the page does not go away and I see the popup. My expectation is based because all the links with this styling share the same kind of functionality. So yes I click on the link.
Computer: Yes I will do as you expect I appear a popup for you

So inside the same popup window you could ask the user to fill the password first and then show the rest of the form in order to apply. Similarly to what you see in the attached picture below. This is the same popup window in two steps. enter image description here

This is inspired from logins/signups where you type in your email first and then the system displays the rest of the dialog (even though at that case the form renders dynamically based on whether it is a login or a signup)

Final tip is that it is not that bad to include a helping tip of explaining why you ask for password. Some people do not comprehend that the password is there just in case they leave their pcs or cellphones available for someone nearby to change their credential while they are making a cup of coffee for example.
Security people think that this is obvious but most users I ask they do not understand why, they only understand that it is for security reasons in general.
By explaining you will benefit that they user is not so upset that you made him or her leave his clicking and tapping session to get on with the keyboard again :)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.