Questions tagged [authentication]

use this tag for questions related to authentication in the context of security

Filter by
Sorted by
Tagged with
2 votes
2 answers
52 views

What should the default 2FA method be for a user opening an account?

Our application (investment solution) asks users to set up a 2FA method after setting their password during onboarding. We offer multiple methods of 2FA; memorable questions, text message security, ...
tribaljester's user avatar
2 votes
2 answers
155 views

Is a process secure if it's not perceived as such?

We just finished research for an article on 2FA (Two-Factor Authentication) and, while writing the report on the insights, I got wondering on this particular finding: Our research indicates that most ...
Devin's user avatar
  • 37.9k
2 votes
1 answer
72 views

Should authenticated users still see the app's public home page

Let's take two examples: GitHub → the public page at github.com is a presentation of GitHub's features. Once a user is logged in, he never sees this home page again: github.com become the user's ...
Zwyx's user avatar
  • 123
2 votes
1 answer
350 views

iOS apps log users out when upgrading to a new phone

Why do so many apps log users out after upgrading to a new phone ? (ex: Gmail, Slack, Instagram). From a technical POV it's easy to keep the user logged in after a phone upgrade. Is there any upside ...
tsp's user avatar
  • 123
2 votes
3 answers
103 views

Does onboarding include sign up?

I'm designing a matchmaking platform for influencers and marketers. I want to create a secure platform that verifies identities (both influencers, and marketers that work for legit brands). I am ...
Maus's user avatar
  • 21
0 votes
1 answer
42 views

Whats the best approach to restoring access to a user who can't access their email?

I'm trying to think of different methods to restore an account to a user who can no longer access their email. For my project, regaining account access is very important, throwing away an account is ...
Trevor Wood's user avatar
0 votes
2 answers
264 views

2FA into the login page (without email or phone number)

I have a question regarding UX of the 2nd factor authentication (2FA) process. It is common in the authentication process to ask for user id (commonly email) + password, and in a second step ask for ...
lcssanches's user avatar
0 votes
3 answers
2k views

Good UX for validating both phone and email

A website requires users to validate their email – it's how the user receives their password creation link, and email is essential to several core workflows. There is now also a need to collect and ...
Izquierdo's user avatar
  • 12.5k
1 vote
1 answer
97 views

How would you visualize authorization deviation with 90+ rules?

Users can preselect an authorization set (1). And, later on, modify the set. As a user, I want to see how the original authorization set differs from the one I changed. So I can see which ...
YengarIV's user avatar
3 votes
1 answer
83 views

Evolution of authentication-based navigation

Consider the case where an unauthenticated user sees a main navigation with a few items: In the old days, someone with admin privileges might log in and simply see additional items exclusive to their ...
Izquierdo's user avatar
  • 12.5k
1 vote
1 answer
69 views

Quantifying the impact of offering alternative signup/login methods?

Nowadays it's common for websites to offer signup/signin methods that don't require making an account (email/password) for that specific site, for example 'Login with x': Facebook Google Twitter ...
stevec's user avatar
  • 289
2 votes
1 answer
309 views

Should users be given a way to link a password after social auth?

Obviously it is very common for sites to allow log in using both the traditional email/password as well as social authentication using Facebook, Google, Twitter etc. If a user creates an account using ...
Charles's user avatar
  • 121
0 votes
2 answers
57 views

How many times should an unverified user be allowed to post on a social site?

If you allowed user to post content on social media site prior to verifying email, in order to increase conversions, how many times should he be allowed to do so? What anti-spam measures you can put ...
Milami's user avatar
  • 1
1 vote
1 answer
255 views

User signs up using their Facebook account logs and then logs in with their (same email) Google account. Now what?

Our web app (a personal calendar-management tool) offers both Facebook and Google as social login providers. Sometimes a user who originally signed up using a Facebook account tries to log in using ...
Justin Grant's user avatar
  • 1,843
5 votes
5 answers
256 views

Validation without an explicit confirmation

I am currently working on an app. This app has some features that the user can unlock by entering a numeric code. I was considering putting an automatic validation as soon as the user types the last ...
Mel's user avatar
  • 115
0 votes
1 answer
251 views

Best way to suggest enabling cross-site cookies with Brave

For technical reasons (OIDC library uses CORS requests to renew API access tokens), our application requires that when using the Brave browser, the security shields built into Brave be either disabled ...
Josh G's user avatar
  • 103
2 votes
1 answer
128 views

How to design interactions for guiding users to install an application during sign up process

Application objective We have a mobile application where a sales employee will be able to login to see his sales stats for the month. The data available to the employee is restricted to only his own ...
Lauren van der Vyver's user avatar
1 vote
2 answers
259 views

What would be the success criteria for user testing for 2FA authentication

i'm conducting a user testing session for a few prototypes. one of the prototypes of a feature i'll be testing is the 2 factor authentication. Compared to other features which have more of an ...
Blue Ocean's user avatar
  • 10.7k
0 votes
4 answers
273 views

At what step in the user flow of a travel booking app would 2FA OTP be needed

i'm designing a 2FA OPT feature for an app that lets users book flights and trains. As users are able to store personal information including their payment details, this level of verification is ...
Blue Ocean's user avatar
  • 10.7k
0 votes
1 answer
39 views

Which is the best way to present to the user a 2-categories-login-field?

I have a login screen that has two ways of authentication: via e-mail or a numeric code. So i'm wondering if i should make the user decide(use a tab-bar or a switch...) which kind of login auth he ...
Alexandre Soares's user avatar
4 votes
2 answers
496 views

How to get around wanting to use email as unique login, but having existing users with multiple accounts per email?

I viewed Should multiple user accounts be allowed to use the same email address? My problem is that we're writing the new version of our website, but need to migrate the old user database to the new ...
FrankDrebin893's user avatar
1 vote
1 answer
127 views

Button appears in two important locations and feels redundant

I'm building a log in page but ran into an issue with my nav bar. As you can see the "Log In" button appears in two locations. What's the best way to approach this? To me it looks odd to have it ...
SR-117's user avatar
  • 13
4 votes
2 answers
207 views

What are the advantages of selfies for security?

A former client of us hired us again after 3 years. In that period, they had many changes, one of them the use of selfies for security reasons. I have found this type of security from time to time, ...
Devin's user avatar
  • 37.9k
1 vote
4 answers
2k views

How to Block Multiple Logins /Sign Up?

So, I have an App where the user needs to sign up to access the app. I'm planning to run an offer where user can order that item only once in a day. But I have the doubt that he may change login Id (...
Anas Idris's user avatar
0 votes
1 answer
134 views

Automatical Button-Less Login

I'm working on a project where we want to setup a button-less login form. The idea is, if you enter your credentials correctly, you will get logged in automatically (don't have to press ENTER or ...
CoderPi's user avatar
  • 101
2 votes
4 answers
95 views

Will users tolerate starting over when their key identification is changed?

The main function of my app: Two users select each other by phone number Neither of them is aware of the other at the beginning Based on certain activities over time, an event happens for both Due ...
mylket's user avatar
  • 123
2 votes
1 answer
71 views

Example workflow when changing a site's identify provider

I'm switching a site from ADFS/AD to Azure B2C/AAD and require users to reset their password. Users will also see different log in screens. I'm struggling to find an approach where users won't be ...
Kye's user avatar
  • 125
0 votes
1 answer
154 views

Smartphone-only apps: consequences of limiting one account per phone number?

For smartphone-only apps that require each user to be a person (apps where there is no room for people to have multiple accounts), what are the negative consequences of limiting each phone number to ...
user avatar
2 votes
2 answers
2k views

Get the user to accept Terms & Conditions when signing up with OAuth

The register form I'm working on allows the user to sign up using their Facebook account or to create a new account by typing their email and password. Here a mockup: Currently, clicking on the ...
robertdev's user avatar
2 votes
2 answers
314 views

Layman's term and description for 2-Step Verification process

Many of us are probably used to seeing or hearing the term 'Two factor authentication' or '2 Step Verification' process by now, although we are probably more familiar with the interaction involved (i....
Michael Lai's user avatar
  • 26.8k
1 vote
4 answers
3k views

How to clearly distinguish a login page from a register page?

I recently conducted a series of user experience evaluation sessions for a prototype application that had been developed with the goal of capturing user experience bottlenecks and other issues. Each ...
Adam McKenna's user avatar
5 votes
1 answer
2k views

What is the proper way to change user email?

I could just put "Email:" field into "Edit profile" form (that is the form to edit current user information) of my site. But this way it is possible that a user both changes the email in a wrong way ...
porton's user avatar
  • 211
0 votes
1 answer
241 views

Webpage behavior for an expired authentication referral link

I'm working on a Single Sign On service. An example use case I'm trying to solve is as follows: User A sends User B a link to www.exampleapp.com/resource/abc. This resource requires authentication ...
dwjohnston's user avatar
1 vote
1 answer
6k views

Good UX practices for 2 factor authentication 2FA

I am designing a mobile app that must use two factor authentication. Do you know good practices or research in that field? One of my concerns is that non tech savvy users may get lost or confused if ...
Rafał Drewnowski's user avatar
2 votes
2 answers
407 views

Is there a name for the UX pattern where you enter a code from an unauthenticated device on an authenticated one in order to login?

Several services such as YouTube, Plex, and XFINITY use a pattern in which an unauthenticated device displays a code for the user to enter on an authenticated device. When the user enters the code on ...
dstaley's user avatar
  • 123
5 votes
8 answers
7k views

Verifying an account with SMS as opposed to email address

In order to be more secure we're looking into account verification. The two options are: Email address verification (Asking the user to click a link in an email sent to their account to verify the ...
Mitch's user avatar
  • 593
1 vote
1 answer
116 views

Authenticating / Validating a user, from an email/SMS invite

I'm designing a system whereby a company creates accounts for it's customers and sends an invite via email/SMS. The system contains PII, so we need to be cautious with data security. We need a ...
Rob's user avatar
  • 11
1 vote
4 answers
11k views

What is the terminology for the page to which the user is redirected to, after successful login?

I did quite a search for this both online and offline, but couldn't find a satisfiable answer. Some of my colleagues suggested terminologies like Dashboard, Home page, Welcome page, landing page, etc. ...
Samu's user avatar
  • 111
4 votes
2 answers
657 views

Is Gmail verification really user friendly?

I want to access my gmail, but when I try to login in via the web it shows an alert "verify its you". In case if I lost my mobile or the phone is dead or network is down, I'm unable to verify the code ...
Pradeep's user avatar
  • 2,984
5 votes
4 answers
1k views

How to prevent creation of multiple accounts under the same company?

Let's say there's Company ABC and Employee A signed-up for an account under his own email address (e.g. [email protected]). However, let's say Employee B signed-up under the same company but ...
catandmouse's user avatar
  • 4,278
1 vote
2 answers
134 views

Presentation of public and private instances

In my application there exist publicly available and browsable objects. However, users are also able to register, authenticate and then author and manage their own personal instances of these same ...
Derek Chasse's user avatar
2 votes
1 answer
644 views

What is the best way to integrate OAuth into an existing authentication system?

I'm currently working on a project to integrate OAuth with a pre-existing, in-house auth system. We have uncovered a number of potential issues, and I'm surprised to find so little online about what I ...
rykener's user avatar
  • 131
3 votes
3 answers
924 views

Two factor authentication in a single form

We are working on implementing a Google two factor authentication in our app. Each customer can turn 2FA on and off for their users in app settings. There was an idea to tweak this functionality. We ...
mintpandapl's user avatar
1 vote
3 answers
374 views

Giving user a preference to pick either TouchID or Pin login on iOS platform

As of iPhone5s we have technology like TouchID which is much secure way of authenticating user instead writing long complicated passwords. Although, we also have a pin login which does require minimal ...
Low Ego's user avatar
  • 13
2 votes
2 answers
3k views

What are the pro's and con's of an extended user session?

When having a portal where due to regulations, the content displayed inside must be accessed through user authentication (username / password). Are there best practices / pros and cons of having ...
Daniel Viquez's user avatar
3 votes
5 answers
988 views

What happens when users are given a secret URL instead of a username/password?

I'm on the fence in regards to whether I should implement user accounts or secret URLs. There are pros and cons to both, and I'm currently leaning in favor of the secret URLs because of the simplicity:...
davidtgq's user avatar
  • 339
2 votes
1 answer
171 views

different pricing for new customers VS. existing customers

how would you go about showing different prices to different users? currently working on a mobile network's website, and its been requested to show different pricing depending on if the user is new ...
Holly McLean's user avatar
2 votes
1 answer
250 views

When using embedded browser authentication, how can I increase user trust?

I have run into this situation before but I will speak specifically about a current project, since it is a good example. I am building a desktop application that uses the Stack Exchange API, and ...
Jason C's user avatar
  • 2,622
1 vote
2 answers
110 views

App authentication providers

I'm in the early stages of developing a new Android app which will require authentication (data driven app using Firebase database with user specific data). I've considered authentication options and ...
Jonny Wright's user avatar
1 vote
3 answers
72 views

Best format and maximum length for manually typed authentication code

I need to send one-time codes with a relatively short expiration time (say 15 minutes). Potentially there may be hundreds of codes active at the same time. What are suggested formats for this? Any ...
gzost's user avatar
  • 133