I am working on a financial web app which clients access to view their funds.
Currently the clients are sent a letter with a temporary password for first login which when used takes them to a change password screen.
This screen asks to
- re-enter characters from the temporary password
- enter and re-enter the new password.
Once this is done the user gets a 'you've changed your password' confirmation and is kicked back to the login screen.
My questions are:
Should the user have to re-enter part (or all) of the temporary password on the change password screen in this instance (as it is the only screen the temporary password can take you to). My thoughts are that they should be presented with a message saying '"i, this is your first login to XX application, for your security please change your password' and provide the input to change password.
Once changed, should they be then continue with the rest of the setup journey (choosing another security passphrase and entering personal) or be kicked out to re-login with the new password?