1

I was wondering about changing a password in an application. Is it more correct to ask as usual, all three (old, new and confirm) passwords on the same page or is it better to ask for the old password on the first page beforehand? Once prior one verified, asking for the new and confirmation passwords on second page.

The aim is to make users focus on only one form at a time so that, making recognition more easier and immediate. I was wondering whether it's more or less convenient in terms of specific reasons and is there any security problems for each pattern.

enter image description here

Improve this question
1
  • One slight advantage to more than one page is that browsers will have an easier time realizing which is the new password -- as long as you're sure to also restate the username on the second page.
    – Luke Sawczak
    Commented Aug 25, 2021 at 20:18

1 Answer 1

Reset to default
1

Since these are only 3 inputs, I don't see a cognitive load problem with a single-page solution.

What kind of security issues do you have in mind? I don't think if you split this into two sections you'd have to store the old password in a cache or anything like that. It has to pass a check anyway.

Improve this answer
1
  • I'm not sure. Was thinking at something like a bigger vulnerability at bruteforce attacks or something like this considering that there is only a field and has a directly request. I also don't think that in this specific phase there are limitations on attempts like during the login.
    – Francesco Fagioli
    Commented Aug 23, 2021 at 15:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.