2

I am reviewing a banking site and the site has change password link upfront on the login page with an option for old password and new password, which verifies the old password before changing to the newer password.

I would ideally place this option inside the product after login, with-in settings or My Account page. But don't have any concrete reason apart from reducing the clutter.

Is there a possible usability flow in it because I have never seen change password option near the login page? Should I let it go or raise an alarm?

Improve this question
1
  • I agree on your reducing the clutter thought. In addition to that I would personally be a bit put off using a banking service that's advocating to change user passwords before the user is even authenticated. It just doesn't have a professional ring to it.
    – AndroidHustle
    Oct 31, 2012 at 9:11

1 Answer 1

Reset to default
3

There are two arguments you can use while raising the alarm (which I think you should)

(1) Login and Change Password are two completely different activities, and should be separated. If not the user might get confused by the clutter (as you mention) and even worse, your users might think it is Forget Password which is yet another activity. Keep separate activities apart.

(2) When we do applications we rely on conventions. How has this problem been solved before? A quick, non-scientific method you can use is to do an image search of “login” and “change password”, and you’ll quickly build a result set of the conventions of login and change password. Unless you have a very good reason to break conventions – then don’t. The stakeholders wanting to break convention are the ones needing to prove there standpoint – not you.

Improve this answer
2
  • 1
    I'd also argue that the "change password" feature is something you only want the secured user to be able to do. If I was a hacker trying to take over control of an account if there was even the tiniest of flaws in your change password logic that enabled me to make the change without being authenticated it would be a major advantage. That said, even once logged in, ensure you collect the "old password" and verify it before making the change... to ensure that a user that has stepped away isn't opening their account for being taken.
    – scunliffe
    Oct 31, 2012 at 14:25
  • @scunliffe Couldn't have written it better myself. Thanx!
    – Benny Skogberg
    Oct 31, 2012 at 14:37

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.