Questions tagged [authentication]

confirmation that a user is who they claim to be, either by verifying what they know (password), what they have (a key) or what they are (fingerprints).

Filter by
Sorted by
Tagged with
0
votes
2answers
161 views

2FA into the login page (without email or phone number)

I have a question regarding UX of the 2nd factor authentication (2FA) process. It is common in the authentication process to ask for user id (commonly email) + password, and in a second step ask for ...
1
vote
0answers
72 views

Should biometric authentication grant authorization to the previously logged in user in an Android app?

I want my users to be able to use biometrics for easier access, but I'm not sure if it's a standard practice (having in mind the security of it). I'm thinking of a situation where user A logged in on ...
1
vote
3answers
87 views

Good UX for validating both phone and email

A website requires users to validate their email – it's how the user receives their password creation link, and email is essential to several core workflows. There is now also a need to collect and ...
1
vote
1answer
70 views

How would you visualize authorization deviation with 90+ rules?

Users can preselect an authorization set (1). And, later on, modify the set. As a user, I want to see how the original authorization set differs from the one I changed. So I can see which ...
3
votes
1answer
69 views

Evolution of authentication-based navigation

Consider the case where an unauthenticated user sees a main navigation with a few items: In the old days, someone with admin privileges might log in and simply see additional items exclusive to their ...
1
vote
1answer
45 views

Quantifying the impact of offering alternative signup/login methods?

Nowadays it's common for websites to offer signup/signin methods that don't require making an account (email/password) for that specific site, for example 'Login with x': Facebook Google Twitter ...
1
vote
1answer
48 views

Should users be given a way to link a password after social auth?

Obviously it is very common for sites to allow log in using both the traditional email/password as well as social authentication using Facebook, Google, Twitter etc. If a user creates an account using ...
0
votes
2answers
38 views

How many times should an unverified user be allowed to post on a social site?

If you allowed user to post content on social media site prior to verifying email, in order to increase conversions, how many times should he be allowed to do so? What anti-spam measures you can put ...
1
vote
1answer
225 views

User signs up using their Facebook account logs and then logs in with their (same email) Google account. Now what?

Our web app (a personal calendar-management tool) offers both Facebook and Google as social login providers. Sometimes a user who originally signed up using a Facebook account tries to log in using ...
5
votes
5answers
130 views

Validation without an explicit confirmation

I am currently working on an app. This app has some features that the user can unlock by entering a numeric code. I was considering putting an automatic validation as soon as the user types the last ...
0
votes
1answer
142 views

Best way to suggest enabling cross-site cookies with Brave

For technical reasons (OIDC library uses CORS requests to renew API access tokens), our application requires that when using the Brave browser, the security shields built into Brave be either disabled ...
1
vote
1answer
79 views

How to design interactions for guiding users to install an application during sign up process

Application objective We have a mobile application where a sales employee will be able to login to see his sales stats for the month. The data available to the employee is restricted to only his own ...
1
vote
2answers
119 views

What would be the success criteria for user testing for 2FA authentication

i'm conducting a user testing session for a few prototypes. one of the prototypes of a feature i'll be testing is the 2 factor authentication. Compared to other features which have more of an ...
0
votes
4answers
172 views

At what step in the user flow of a travel booking app would 2FA OTP be needed

i'm designing a 2FA OPT feature for an app that lets users book flights and trains. As users are able to store personal information including their payment details, this level of verification is ...
0
votes
1answer
36 views

Which is the best way to present to the user a 2-categories-login-field?

I have a login screen that has two ways of authentication: via e-mail or a numeric code. So i'm wondering if i should make the user decide(use a tab-bar or a switch...) which kind of login auth he ...
3
votes
2answers
224 views

How to get around wanting to use email as unique login, but having existing users with multiple accounts per email?

I viewed Should multiple user accounts be allowed to use the same email address? My problem is that we're writing the new version of our website, but need to migrate the old user database to the new ...
1
vote
1answer
115 views

Button appears in two important locations and feels redundant

I'm building a log in page but ran into an issue with my nav bar. As you can see the "Log In" button appears in two locations. What's the best way to approach this? To me it looks odd to have it ...
4
votes
2answers
194 views

What are the advantages of selfies for security?

A former client of us hired us again after 3 years. In that period, they had many changes, one of them the use of selfies for security reasons. I have found this type of security from time to time, ...
1
vote
4answers
1k views

How to Block Multiple Logins /Sign Up?

So, I have an App where the user needs to sign up to access the app. I'm planning to run an offer where user can order that item only once in a day. But I have the doubt that he may change login Id (...
0
votes
1answer
118 views

Automatical Button-Less Login

I'm working on a project where we want to setup a button-less login form. The idea is, if you enter your credentials correctly, you will get logged in automatically (don't have to press ENTER or ...
2
votes
4answers
88 views

Will users tolerate starting over when their key identification is changed?

The main function of my app: Two users select each other by phone number Neither of them is aware of the other at the beginning Based on certain activities over time, an event happens for both Due ...
2
votes
1answer
59 views

Example workflow when changing a site's identify provider

I'm switching a site from ADFS/AD to Azure B2C/AAD and require users to reset their password. Users will also see different log in screens. I'm struggling to find an approach where users won't be ...
0
votes
1answer
96 views

Smartphone-only apps: consequences of limiting one account per phone number?

For smartphone-only apps that require each user to be a person (apps where there is no room for people to have multiple accounts), what are the negative consequences of limiting each phone number to ...
2
votes
2answers
758 views

Get the user to accept Terms & Conditions when signing up with OAuth

The register form I'm working on allows the user to sign up using their Facebook account or to create a new account by typing their email and password. Here a mockup: Currently, clicking on the ...
2
votes
2answers
158 views

Layman's term and description for 2-Step Verification process

Many of us are probably used to seeing or hearing the term 'Two factor authentication' or '2 Step Verification' process by now, although we are probably more familiar with the interaction involved (i....
1
vote
4answers
2k views

How to clearly distinguish a login page from a register page?

I recently conducted a series of user experience evaluation sessions for a prototype application that had been developed with the goal of capturing user experience bottlenecks and other issues. Each ...
3
votes
1answer
761 views

What is the proper way to change user email?

I could just put "Email:" field into "Edit profile" form (that is the form to edit current user information) of my site. But this way it is possible that a user both changes the email in a wrong way ...
0
votes
1answer
147 views

Webpage behavior for an expired authentication referral link

I'm working on a Single Sign On service. An example use case I'm trying to solve is as follows: User A sends User B a link to www.exampleapp.com/resource/abc. This resource requires authentication ...
1
vote
1answer
5k views

Good UX practices for 2 factor authentication 2FA

I am designing a mobile app that must use two factor authentication. Do you know good practices or research in that field? One of my concerns is that non tech savvy users may get lost or confused if ...
2
votes
2answers
360 views

Is there a name for the UX pattern where you enter a code from an unauthenticated device on an authenticated one in order to login?

Several services such as YouTube, Plex, and XFINITY use a pattern in which an unauthenticated device displays a code for the user to enter on an authenticated device. When the user enters the code on ...
5
votes
8answers
6k views

Verifying an account with SMS as opposed to email address

In order to be more secure we're looking into account verification. The two options are: Email address verification (Asking the user to click a link in an email sent to their account to verify the ...
1
vote
1answer
89 views

Authenticating / Validating a user, from an email/SMS invite

I'm designing a system whereby a company creates accounts for it's customers and sends an invite via email/SMS. The system contains PII, so we need to be cautious with data security. We need a ...
1
vote
4answers
4k views

What is the terminology for the page to which the user is redirected to, after successful login?

I did quite a search for this both online and offline, but couldn't find a satisfiable answer. Some of my colleagues suggested terminologies like Dashboard, Home page, Welcome page, landing page, etc. ...
4
votes
2answers
588 views

Is Gmail verification really user friendly?

I want to access my gmail, but when I try to login in via the web it shows an alert "verify its you". In case if I lost my mobile or the phone is dead or network is down, I'm unable to verify the code ...
5
votes
4answers
960 views

How to prevent creation of multiple accounts under the same company?

Let's say there's Company ABC and Employee A signed-up for an account under his own email address (e.g. employeeA@companyabc.com). However, let's say Employee B signed-up under the same company but ...
1
vote
2answers
117 views

Presentation of public and private instances

In my application there exist publicly available and browsable objects. However, users are also able to register, authenticate and then author and manage their own personal instances of these same ...
2
votes
1answer
465 views

What is the best way to integrate OAuth into an existing authentication system?

I'm currently working on a project to integrate OAuth with a pre-existing, in-house auth system. We have uncovered a number of potential issues, and I'm surprised to find so little online about what I ...
3
votes
3answers
748 views

Two factor authentication in a single form

We are working on implementing a Google two factor authentication in our app. Each customer can turn 2FA on and off for their users in app settings. There was an idea to tweak this functionality. We ...
1
vote
3answers
341 views

Giving user a preference to pick either TouchID or Pin login on iOS platform

As of iPhone5s we have technology like TouchID which is much secure way of authenticating user instead writing long complicated passwords. Although, we also have a pin login which does require minimal ...
2
votes
2answers
2k views

What are the pro's and con's of an extended user session?

When having a portal where due to regulations, the content displayed inside must be accessed through user authentication (username / password). Are there best practices / pros and cons of having ...
3
votes
5answers
617 views

What happens when users are given a secret URL instead of a username/password?

I'm on the fence in regards to whether I should implement user accounts or secret URLs. There are pros and cons to both, and I'm currently leaning in favor of the secret URLs because of the simplicity:...
2
votes
1answer
151 views

different pricing for new customers VS. existing customers

how would you go about showing different prices to different users? currently working on a mobile network's website, and its been requested to show different pricing depending on if the user is new ...
2
votes
1answer
187 views

When using embedded browser authentication, how can I increase user trust?

I have run into this situation before but I will speak specifically about a current project, since it is a good example. I am building a desktop application that uses the Stack Exchange API, and ...
1
vote
2answers
104 views

App authentication providers

I'm in the early stages of developing a new Android app which will require authentication (data driven app using Firebase database with user specific data). I've considered authentication options and ...
1
vote
3answers
66 views

Best format and maximum length for manually typed authentication code

I need to send one-time codes with a relatively short expiration time (say 15 minutes). Potentially there may be hundreds of codes active at the same time. What are suggested formats for this? Any ...
1
vote
1answer
54 views

For a closed off API, is not more friendly to have only a 'secret' - no 'username'?

Quite a few API's have something like a 'username' and a 'secret'. Is there anything against the decission to just work with a (generated) secret? Of course the secret should be long enough - GUID ...
0
votes
1answer
50 views

Allow users to mark asset as "found" without account?

I have a website where a user can post something they are looking for and the ad gets distributed out to a public board (technically multiple) anyone can see. Up to this point (99% of the site) my ...
1
vote
1answer
117 views

Common email pitfalls for social login integrations

We are planning to implement social logins on our site. (Potentially via a service like Janrain or Auth0.) For us the user's email is key, so we will implement only services that expose the user's ...
0
votes
1answer
263 views

Separators in user config screen (Polymer/material) [closed]

I managed to create a usable screen to manage credentials. It's a bit tricky, because users can set login/password pair, as well as Facebook. However, a user could have just facebook, just login/pass, ...
5
votes
1answer
2k views

What percent of Android users with fingerprint enabled phones use the fingerprint feature?

We recently added Android fingerprint authentication to our app. Currently, only 51% of users who have seen the fingerprint prompt have enabled the feature. I'm not sure if the number is low due to ...