I am working on project for a very secure sensitive website in which the objective is to make the "unlock account" workflow easy and intuitive. Currently, if user enters wrong username and password combo 3 times, s/he is temporary locked out of system but is given a "unlock your account" option. But next page requires a number of fields and for some reason a low percentage of users make it past this page. And if user clicks "forgot both username and password" it leads to a page in which they need to re-register. Of course, most will bounce at that.

Note, my first suggestion was to allow email addresses as usernames since no one forgets their email address but client said it would require way too much effort at this stage. Does anyone have any ideas of user can easily unlock account for a highly secure site? We want to find that balance of usability and security.

  • 2
    Welcome to the site! If you show us what you have so far, it will be easier for us to provide feedback. Commented May 22, 2013 at 23:46
  • will do. i need to edit it a bit to not give away the company name since its a very well recognized company. will get something up tomorrow.
    – ih123
    Commented May 23, 2013 at 2:41
  • 2
    Sounds good. Note that there's a button above the text box to create (and embed) a Balsamiq mockup; it could be a quick way for you to demo a lo-fi version of what you mean. Alternatively, you could upload an image to a hosting site and post a link; a more senior user (with permission to post images) can then edit your post to include the image inline. Commented May 23, 2013 at 3:19
  • I would similarly ask for more info about what is contained on that second page. Security questions are usually a good idea. It also depends on what other information you keep about someone that you can ask, zip codes, last 4 digits of SSN, things like that can be good extra authentication items that usually don't change frequently and people are unlikely to forget.
    – ekinnear
    Commented May 23, 2013 at 17:47
  • Is this workflow intended to be used in one country, or in many different cultures? Like, for example, the SSN is a USA-only feature.
    – Juan Lanus
    Commented May 28, 2013 at 22:47

1 Answer 1


Firstly, there is Google's solution, which is to become physical.
An option to recover the password is to be sent a code to a previously registered and verified cell phone. When you want to reset your password you get a text message in your cellphone. You are taken to a page that, upon entering the right number, takes you to the password resetting form.

Another solution is the questions: the user chooses and/or writes, two or three questions that he can easily answer but hackers dont, like what was the color of your first car. Provide a list of questions, and also allow the user to write his own, maybe in his own language using their special alphabet.
This can be mixed with questions like what is your identification number where USA people can enter the SSN and we argies the DNI.

The idea is to get physical, that is, require the user to show knowledge about something that's outside the virtual world where an impostor can move with ease.
For example if you were an airline ticket online seller, you could ask the user where did he travel to the last time.
To avoid dropping users you should exhibit some elasticity, like allowing the user not to remember very well the last trip and answer instead with the previous one. In this case you display a list of random answers that also contains the right one.

In this type of interactions it's important to brainstorm many use cases that might show over time, and implement a design that will work in most cases.
The 300 million button case is an example where the original designers didn't consider cases like one that comes back after a long while and doesn't remember his data very well. Like, the email address of 4 years ago.
For example, recently I was asked in which month did I change my password. Not the slightest idea ... It is good to offer options, as Google does. Like, text message or questions.
If you are going to be elastic, allowing for some lack of precision in the user answers, you should brainstorm a minimal level of certainty like 3 out of 4 where the good answers must include at least 2 of the most difficult to fake.

  • #winces# I'd avoid explicitly asking for an SSN (unless you absolutely need it), as those tend to be major targets. Commented May 28, 2013 at 23:44
  • These sound like really bad examples. The colour of your first car? 20% chance it's white. Where did the user travel to last time? Bots can hit the big cities to play the odds. Commented May 29, 2013 at 1:47
  • Hi @Steve. Yes, my first car was white, you got me. But my quick and dirty examples don't force anybody to use them. Anyway, bots can't against this kind of interaction because it's a mined field: as soon as you get a bit out of the trail, boom! and you are history. In fact, I'm suggesting (based on personal experience) to let the trail be a bit wider. But not as much as to let bots answer three questions in a row by brute force.
    – Juan Lanus
    Commented May 30, 2013 at 12:27
  • thanks for the responses. i think these can work but i did some research and figured that after the 2nd failed attempt, the interface should be slightly different with a major call to action to use the "forgot password" or "forgot username" option and then much less prominent is the log in field. There would be accompanying text prompting user to go to forgot PW/UN or risk being in password hell aka account locked. There are other tricks i am implementing but the main solution here is to TRY to force user to use "Forgot Password" or "Forgot Username" so they dont get locked out.
    – ih123
    Commented May 31, 2013 at 1:23
  • Yes, you are right. IMO the user will be forced after N failed attempts thus the forgot options will be their only options. I focused on what happens after the user chose the forgot option. Like for example as a last resort to let them call somebody human, if possible.
    – Juan Lanus
    Commented Jun 1, 2013 at 2:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.