3

I am working on a financial web app which clients access to view their funds.

Currently the clients are sent a letter with a temporary password for first login which when used takes them to a change password screen.

This screen asks to

  • re-enter characters from the temporary password
  • enter and re-enter the new password.

Once this is done the user gets a 'you've changed your password' confirmation and is kicked back to the login screen.

My questions are:

  • Should the user have to re-enter part (or all) of the temporary password on the change password screen in this instance (as it is the only screen the temporary password can take you to). My thoughts are that they should be presented with a message saying '"i, this is your first login to XX application, for your security please change your password' and provide the input to change password.

  • Once changed, should they be then continue with the rest of the setup journey (choosing another security passphrase and entering personal) or be kicked out to re-login with the new password?

Improve this question
7
  • When you say letter, do you mean an actual letter in the mail, or email?
    – Majo0od
    Aug 26, 2015 at 12:36
  • Snail mail, old school dead tree.
    – steviefish
    Aug 26, 2015 at 12:44
  • Your use of jargon made me chuckle, lol. All joking aside, was there a reason why they decided to use that method?
    – Majo0od
    Aug 26, 2015 at 12:45
  • It is the way it was done originally, and it has not changed. Old fashioned in some ways. It is an area where we are looking to move towards a digital solution but that won't happen soon.
    – steviefish
    Aug 26, 2015 at 12:48
  • I see, so this sort of situation is out of your hands.
    – Majo0od
    Aug 26, 2015 at 12:49

2 Answers 2

Reset to default
1

I am also working on a financial application and we use a similar setup. For new persons who register by physically showing up at the financial institution branch, we send them out both a temporary username and a temporary password - via different channels. For eg. we would send a temporary username to the person's email address and the temporary password as an SMS message to their cellphone. This offers slightly higher protection from someone claiming your account by obtaining access to one of your communication channels (they would need both) and also painlessly verifies two channels for the customer so they don't have to activate them manually.

After many hours of usability research as well as security analysis, we decided that it is perfectly acceptable for the "please change your temporary login credentials" screen to not request the user to re-enter the temporary data that they just used to login. We also decided that after setting the new credentials, they would continue the process of the registration, without the need to login again with the new username and password that they just created.

The process is seamless, fluid and pleasant for the user. It was also deemed secure by analysts who examined it and has withstood the real world test, as the application has been in production use for almost a year now.

My suggestion would be to make it simple, easy and fluid for the user as any possible security benefits from making them re-enter credentials right after creating them is minimal at best.

Improve this answer
2
  • The two channel setup is a great idea! I hadn't thought of that. The skipping the re-entering of the temporary password was what I was leaning towards (perhaps with a short-ish timeout of 5min or so) and then forcing a re-log-in once all the setup screens were filled in. I was thining that this would be clearly signposted and presented in such a way as to allow the user to feel that he was trying out the new sign in credentials
    – steviefish
    Aug 26, 2015 at 12:25
  • Sure, we also have a timeout after you initially enter the temporary password, if you do not set a new password on time, in our case it kicks you back to the login screen where you can login again with the temp data. I'll admit we could have handled this timeout better, display a coherent message and offer the user to re-enter the temporary password on that screen, instead of reloading. But oh well, time and budget limits :)
    – irreal
    Aug 26, 2015 at 12:33
0

The idea of asking for partial number of characters is good but the user will tend to copy the password from the mail and will paste here. A partial input will make the user work more and i guess that is not required.

In the other way around, if you get the mail id from the user while signing up, you can mail him/her a link which will ask them for the password. This will reduce the copy and paste work too. You also verify the account and reduce the burden of the user.

The user can very well be taken into your app instead looping him to the login screen. They will save the account data with their browsers or with any third party account holder plugins.

Hope this gives some clarification to you. Cheers!

Improve this answer
2
  • The letter is hard copy sent via snail mail rather than an email. In time we will be moving to fully electronic but that is in the future (Finance works in funny ways).
    – steviefish
    Aug 26, 2015 at 10:54
  • In that case it depends on the number of characters you have in the password. If it is say < 4 or 5, the entire password can be asked to be fed in else the last few(you can say the number) can be fed in for the verification
    – user3464111
    Aug 26, 2015 at 10:57

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.