Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [authentication]

confirmation that a user is who they claim to be, either by verifying what they know (password), what they have (a key) or what they are (fingerprints).

2
votes
1answer
47 views

Example workflow when changing a site's identify provider

I'm switching a site from ADFS/AD to Azure B2C/AAD and require users to reset their password. Users will also see different log in screens. I'm struggling to find an approach where users won't be ...
0
votes
1answer
42 views

Smartphone-only apps: consequences of limiting one account per phone number?

For smartphone-only apps that require each user to be a person (apps where there is no room for people to have multiple accounts), what are the negative consequences of limiting each phone number to ...
1
vote
2answers
67 views

Get the user to accept Terms & Conditions when signing up with OAuth

The register form I'm working on allows the user to sign up using their Facebook account or to create a new account by typing their email and password. Here a mockup: Currently, clicking on the ...
2
votes
2answers
70 views

Layman's term and description for 2-Step Verification process

Many of us are probably used to seeing or hearing the term 'Two factor authentication' or '2 Step Verification' process by now, although we are probably more familiar with the interaction involved (i....
1
vote
4answers
214 views

How to clearly distinguish a login page from a register page?

I recently conducted a series of user experience evaluation sessions for a prototype application that had been developed with the goal of capturing user experience bottlenecks and other issues. Each ...
1
vote
1answer
147 views

What is the proper way to change user email?

I could just put "Email:" field into "Edit profile" form (that is the form to edit current user information) of my site. But this way it is possible that a user both changes the email in a wrong way ...
0
votes
1answer
68 views

Webpage behavior for an expired authentication referral link

I'm working on a Single Sign On service. An example use case I'm trying to solve is as follows: User A sends User B a link to www.exampleapp.com/resource/abc. This resource requires authentication ...
1
vote
1answer
2k views

Good UX practices for 2 factor authentication 2FA

I am designing a mobile app that must use two factor authentication. Do you know good practices or research in that field? One of my concerns is that non tech savvy users may get lost or confused if ...
3
votes
2answers
238 views

Is there a name for the UX pattern where you enter a code from an unauthenticated device on an authenticated one in order to login?

Several services such as YouTube, Plex, and XFINITY use a pattern in which an unauthenticated device displays a code for the user to enter on an authenticated device. When the user enters the code on ...
5
votes
6answers
770 views

Verifying an account with SMS as opposed to email address

In order to be more secure we're looking into account verification. The two options are: Email address verification (Asking the user to click a link in an email sent to their account to verify the ...
0
votes
1answer
68 views

Authenticating / Validating a user, from an email/SMS invite

I'm designing a system whereby a company creates accounts for it's customers and sends an invite via email/SMS. The system contains PII, so we need to be cautious with data security. We need a ...
0
votes
2answers
321 views

What is the terminology for the page to which the user is redirected to, after successful login?

I did quite a search for this both online and offline, but couldn't find a satisfiable answer. Some of my colleagues suggested terminologies like Dashboard, Home page, Welcome page, landing page, etc. ...
4
votes
2answers
340 views

Is Gmail verification really user friendly?

I want to access my gmail, but when I try to login in via the web it shows an alert "verify its you". In case if I lost my mobile or the phone is dead or network is down, I'm unable to verify the code ...
5
votes
4answers
242 views

How to prevent creation of multiple accounts under the same company?

Let's say there's Company ABC and Employee A signed-up for an account under his own email address (e.g. employeeA@companyabc.com). However, let's say Employee B signed-up under the same company but ...
0
votes
2answers
85 views

Presentation of public and private instances

In my application there exist publicly available and browsable objects. However, users are also able to register, authenticate and then author and manage their own personal instances of these same ...
3
votes
1answer
223 views

What is the best way to integrate OAuth into an existing authentication system?

I'm currently working on a project to integrate OAuth with a pre-existing, in-house auth system. We have uncovered a number of potential issues, and I'm surprised to find so little online about what I ...
2
votes
3answers
476 views

Two factor authentication in a single form

We are working on implementing a Google two factor authentication in our app. Each customer can turn 2FA on and off for their users in app settings. There was an idea to tweak this functionality. We ...
1
vote
3answers
213 views

Giving user a preference to pick either TouchID or Pin login on iOS platform

As of iPhone5s we have technology like TouchID which is much secure way of authenticating user instead writing long complicated passwords. Although, we also have a pin login which does require minimal ...
2
votes
2answers
687 views

What are the pro's and con's of an extended user session?

When having a portal where due to regulations, the content displayed inside must be accessed through user authentication (username / password). Are there best practices / pros and cons of having ...
4
votes
5answers
252 views

What happens when users are given a secret URL instead of a username/password?

I'm on the fence in regards to whether I should implement user accounts or secret URLs. There are pros and cons to both, and I'm currently leaning in favor of the secret URLs because of the simplicity:...
3
votes
1answer
127 views

different pricing for new customers VS. existing customers

how would you go about showing different prices to different users? currently working on a mobile network's website, and its been requested to show different pricing depending on if the user is new ...
3
votes
1answer
131 views

When using embedded browser authentication, how can I increase user trust?

I have run into this situation before but I will speak specifically about a current project, since it is a good example. I am building a desktop application that uses the Stack Exchange API, and ...
1
vote
2answers
96 views

App authentication providers

I'm in the early stages of developing a new Android app which will require authentication (data driven app using Firebase database with user specific data). I've considered authentication options and ...
1
vote
3answers
60 views

Best format and maximum length for manually typed authentication code

I need to send one-time codes with a relatively short expiration time (say 15 minutes). Potentially there may be hundreds of codes active at the same time. What are suggested formats for this? Any ...
1
vote
1answer
46 views

For a closed off API, is not more friendly to have only a 'secret' - no 'username'?

Quite a few API's have something like a 'username' and a 'secret'. Is there anything against the decission to just work with a (generated) secret? Of course the secret should be long enough - GUID ...
0
votes
1answer
46 views

Allow users to mark asset as “found” without account?

I have a website where a user can post something they are looking for and the ad gets distributed out to a public board (technically multiple) anyone can see. Up to this point (99% of the site) my ...
1
vote
1answer
91 views

Common email pitfalls for social login integrations

We are planning to implement social logins on our site. (Potentially via a service like Janrain or Auth0.) For us the user's email is key, so we will implement only services that expose the user's ...
0
votes
1answer
251 views

Separators in user config screen (Polymer/material) [closed]

I managed to create a usable screen to manage credentials. It's a bit tricky, because users can set login/password pair, as well as Facebook. However, a user could have just facebook, just login/pass, ...
5
votes
1answer
1k views

What percent of Android users with fingerprint enabled phones use the fingerprint feature?

We recently added Android fingerprint authentication to our app. Currently, only 51% of users who have seen the fingerprint prompt have enabled the feature. I'm not sure if the number is low due to ...
1
vote
1answer
42 views

Is using screen unlock pattern feature a good option for login on mobile web

trying to come up with way(s) to reduce the users' drop off rate on mobile login/registration on a mobile web ecommerce site. 1 method i think could work and would like to probably test would be a ...
-1
votes
0answers
73 views

Is there a way to verify a user beyond the generic FB Login, token and Touch ID?

I am part of a team that is in the process of creating an app which deals with monetary transfers. Our biggest concern is a receiver of the money being a con/fraud; I was wandering if there was a ...
3
votes
4answers
249 views

User migration when some users signed up to the old system and some to the new one

Our team has a challenging UX issue we are trying to solve neatly. We have rebuilt an existing system from scratch and there is a technical constraint that old users will need to re-register to the ...
2
votes
5answers
218 views

is replying to an sms a reliable way of authenticating a response

I have a web app which will relay messages from my desktop applications (which is a workflow application for my client). A typical message would be - 'you have booked your pc in for a service and we ...
7
votes
7answers
953 views

What is the best mobile number authorization strategy?

In recent years, mobile number has become an important factor for authentication and hence more and more enterprises employ methods to capture their users' mobile numbers using SMS. In a typical ...
3
votes
1answer
59 views

Should web sites have their own authentication?

If I am designing a web site that interacts with the same user over time via email or other messaging mediums, should I allow account creation on the web site using a traditional username/password/...
4
votes
1answer
108 views

How to explain the concept of choosing password to user

We have an online store application that uses one-time passwords for user login. The user enters her email address, and we email her a one-time password to log in with. She doesn't choose any ...
1
vote
2answers
246 views

Linking multiple third-party accounts for a mobile app?

My user wants to access personal content from her Spotify, Soundcloud and other third-party accounts through one native mobile application. Imagine a music player for any personal library. The ...
5
votes
2answers
200 views

Mobile application without direct authorization \ registration

UX \ UI professionals. The question connects both the user experience and data security. We are going to build the app, where the user is going to pay for the services. He should enter his email, ...
4
votes
3answers
522 views

Correct UX for the scenario when a user forgets the answers to their security questions?

We have an application where a user is required upon registration to set up three security questions and answers When they login to the application, they must answer one of the questions after ...
19
votes
5answers
13k views

Is a “Login Successful” Message Necessary?

On an informational/forum website (say, similar to a StackExchange site), is it necessary to show a "login successful" message? Clarification: On the site in question, the users can log in by ...
3
votes
2answers
95 views

Authentication frequency for polling system

I am building a system to be used for polling during an election. Security is a massive issue as I'm sure you understand! We are using two factor authentication so the user will be asked to supply a ...
2
votes
1answer
159 views

If a user has created an account on my iOS app using Google, how should I handle their effort to also create an email account?

Imagine a user logged into my iOS app using their Google account. Months later, they are trying to create an account using their email address (the same one connected to their previous Google social ...
1
vote
3answers
115 views

When entering data, should the user be authenticated on clicking “Create” or “Save”?

Having the two options: Check if user authenticated upon "Save" button click (when the input dialog is shown and filled in with the data) Check if user authenticated upon "Create" button click (...
0
votes
2answers
112 views

Back to login page authentication expiration behaviour

If a user presses back after logging in to a website should the authentication cookie be set to expire because the user expects to be logged out if they can see the login page or not?
1
vote
5answers
338 views

How can I make a login form seem more trustworthy?

We have a web app where the user has to log in at the beginning. The login shows our company logo, the name of the product incl. logo of the product and the login form: I showed this app to a test ...
2
votes
3answers
84 views

Visual indication of special privileges

I'm working on a mobile app for android and iOS that lets you manage sports teams. You can follow any team, but can only manage those your account is associated with (You're the coach, for example) ...
1
vote
2answers
284 views

Which social login should I use, Google OAuth2 or Google+?

Google supports 4 ways to "sign in with google" OAuth OAuth2 Google+ Google Apps I want a generic "sign in with google", I'm not doing anything app-specific, so the last one is out. Presumably ...
6
votes
4answers
2k views

How many atempts should you give a user before invalidating his password?

What I am trying to avoid here is brute force attacks on a user's password. And I am thinking about doing that by invalidating his password when too many attempts are made in the same minute, hour, ...
4
votes
2answers
580 views

Should I verify e-mail format in login form?

My B2B web app's login form has an email and password field. So far, I'm only checking if the fields are empty. I then make my authentication request, if there's a problem I return only one kind of ...
1
vote
1answer
237 views

How to encourage users to download an app to complete strong authentication (two factor)

I'm designing a strong authentication (two factor) solution for a website. Users will be forced to use two factor (legal requirement). We have two supported methods an SMS verification code texted to ...