3

enter image description here

My idea of manage password section is to enable only Current password field at first. If the user enters correct password in the field only then the fields beneath it would go in enable state. Would this be a good way of restricting false users?

2

Developers make user change password, when

  • password is near to expiry
  • forgot password
  • detects a suspicious login, informs user by email/msg and forces the user to change password.

Making the user enter current password makes sense only in the 3rd case. My suggestion would be to avoid asking for current password to an already logged in user. On top of that a non-enabled field might change the mind of the user to change password --> leading to expiry. So don't over-complicate a simple functionality.

Just providing New Password and Re-type Password fields would be best.

  • 1
    "Developers make user change password" In most cases, users can also choose to change their password. In all scenarios, the usual reason for making them enter the current password is to stop a random person passing an unattended PC and changing the password of whoever's logged-in (obviously they shouldn't leave a logged-in PC unattended, but...) – TripeHound Sep 27 '17 at 10:29

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.