16

What is the convention regarding the following scenario:

In a given system, a user is already logged in. He perform some tasks and then he change his own password.

After this point, what should happen next?

  • A simple message saying everything went fine (or not). So the user can keep using the system
  • Force a logout and prompt a new login?
Improve this question
2
  • 1
    So far two answers, one each way. Anyone else?
    – Matías Cánepa
    Apr 29, 2014 at 21:07
  • This is a old question, but I am curious if this is implemented out of box in Identity Apps like Ping Identity, Oracle Access Manager, WSO2 Identity Server, Okta etc.?
    – Saqib Ali
    Feb 15, 2018 at 23:08

2 Answers 2

Reset to default
22

For the most trouble-free experience, you should have the user log in again right there.

Many users have some sort of password manager or use their browser to manage passwords (or scribble it on a sticky note affixed to their monitor… ack!). The only way to assure the user has completed their end of the password change is to log them out and have them go through the process of logging back in at that time.

You don't want users returning days or weeks later only to discover their password manager or browser still has the old password. The only way to assure that the user has completed "their end" of the password management is to have them completely log out and log back in again at the time they changed their password.

Improve this answer
3
  • I agree, at the OS level the OS has few ways of knowing what applications are doing. An email client for example may already have a authenticated token which on password change it doesn't attempt to reauthenticate properly causing issues. So while logging out in itself is not a great UX, it is far better than lockouts and various odd failures for the rest of the day, week, month.
    – Austin French
    Apr 30, 2014 at 0:52
  • If it wasn't for Robert's main point about password managers I'd say not to log the user out. But this is too important to ignore. One of the suggestions in another answer was to send a confirmation email. That is sound practice. Perhaps you could not log the user out until they click on a confirmation link and then do it, which would allow them to reset their password manager.
    – Stonetip
    May 1, 2014 at 6:18
  • I don't understand how is this the accepted answer, it must be because back in 2014 the understanding of user experience was in its early stages and devs cared very little, if at all, about it. You CANNOT rely on passwords managers for the love of God, even if browsers have one. If the user doesn't use one, as per this answer, they're fkd if they are logged out because once they log back in, no password manager is going to remember anything because they don't use one after all. The statement of "For the most trouble-free experience…" is aimed at the developer, not at the user.
    – Ricardo Zea
    Jun 19, 2019 at 12:46
6

There are a few things you want to resolve here:

Maintaining User Orientation

You don't want to disorient the user by forcing a log out. I'd opt for a confirmation screen, and an email confirmation sent. Perhaps with a message indicating that if they did not request this action, provide a method of Undo or Reset again.

Also, if they are locked out, they may not be able to get back in again to change it to something more memorable if they forget their password right away.

Throwing them into the "logged out" screen right away seems like a great idea in theory as it helps the user reinforce their memory, but can be jarring and give the impression that something went wrong.

re: Short Term Memory Load

Some users have short term memory loss due to:

  • The use of Password strength indicators (They may have gone over too many)
  • Memorization without visual representation (Bullets are difficult to memorize)
  • Password character requirements (Pushes users out of their mnemonic comfort zone to create something unreadable)

Source: http://cryptosmith.com/node/230

Improve this answer
0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.