Questions tagged [authentication]

confirmation that a user is who they claim to be, either by verifying what they know (password), what they have (a key) or what they are (fingerprints).

Filter by
Sorted by
Tagged with
0 votes
0 answers
5 views

Best way to seamlessly login and/or create a user account with Facebook on a website?

Wondering how to implement the UX for login in this day and age, if I only allow creating an account / logging in with 3rd party services (such as only allowing Facebook or LinkedIn login, just those ...
user avatar
  • 321
0 votes
1 answer
40 views

Whats the best approach to restoring access to a user who can't access their email?

I'm trying to think of different methods to restore an account to a user who can no longer access their email. For my project, regaining account access is very important, throwing away an account is ...
user avatar
0 votes
2 answers
191 views

2FA into the login page (without email or phone number)

I have a question regarding UX of the 2nd factor authentication (2FA) process. It is common in the authentication process to ask for user id (commonly email) + password, and in a second step ask for ...
user avatar
0 votes
0 answers
79 views

Should biometric authentication grant authorization to the previously logged in user in an Android app?

I want my users to be able to use biometrics for easier access, but I'm not sure if it's a standard practice (having in mind the security of it). I'm thinking of a situation where user A logged in on ...
user avatar
0 votes
3 answers
392 views

Good UX for validating both phone and email

A website requires users to validate their email – it's how the user receives their password creation link, and email is essential to several core workflows. There is now also a need to collect and ...
user avatar
  • 8,769
1 vote
1 answer
76 views

How would you visualize authorization deviation with 90+ rules?

Users can preselect an authorization set (1). And, later on, modify the set. As a user, I want to see how the original authorization set differs from the one I changed. So I can see which ...
user avatar
3 votes
1 answer
73 views

Evolution of authentication-based navigation

Consider the case where an unauthenticated user sees a main navigation with a few items: In the old days, someone with admin privileges might log in and simply see additional items exclusive to their ...
user avatar
  • 8,769
1 vote
1 answer
53 views

Quantifying the impact of offering alternative signup/login methods?

Nowadays it's common for websites to offer signup/signin methods that don't require making an account (email/password) for that specific site, for example 'Login with x': Facebook Google Twitter ...
user avatar
  • 291
2 votes
1 answer
80 views

Should users be given a way to link a password after social auth?

Obviously it is very common for sites to allow log in using both the traditional email/password as well as social authentication using Facebook, Google, Twitter etc. If a user creates an account using ...
user avatar
  • 121
0 votes
2 answers
44 views

How many times should an unverified user be allowed to post on a social site?

If you allowed user to post content on social media site prior to verifying email, in order to increase conversions, how many times should he be allowed to do so? What anti-spam measures you can put ...
user avatar
  • 1
1 vote
1 answer
231 views

User signs up using their Facebook account logs and then logs in with their (same email) Google account. Now what?

Our web app (a personal calendar-management tool) offers both Facebook and Google as social login providers. Sometimes a user who originally signed up using a Facebook account tries to log in using ...
user avatar
  • 1,793
5 votes
5 answers
140 views

Validation without an explicit confirmation

I am currently working on an app. This app has some features that the user can unlock by entering a numeric code. I was considering putting an automatic validation as soon as the user types the last ...
user avatar
  • 95
0 votes
1 answer
174 views

Best way to suggest enabling cross-site cookies with Brave

For technical reasons (OIDC library uses CORS requests to renew API access tokens), our application requires that when using the Brave browser, the security shields built into Brave be either disabled ...
user avatar
  • 103
1 vote
1 answer
86 views

How to design interactions for guiding users to install an application during sign up process

Application objective We have a mobile application where a sales employee will be able to login to see his sales stats for the month. The data available to the employee is restricted to only his own ...
user avatar
1 vote
2 answers
182 views

What would be the success criteria for user testing for 2FA authentication

i'm conducting a user testing session for a few prototypes. one of the prototypes of a feature i'll be testing is the 2 factor authentication. Compared to other features which have more of an ...
user avatar
  • 10.5k
0 votes
4 answers
208 views

At what step in the user flow of a travel booking app would 2FA OTP be needed

i'm designing a 2FA OPT feature for an app that lets users book flights and trains. As users are able to store personal information including their payment details, this level of verification is ...
user avatar
  • 10.5k
0 votes
1 answer
39 views

Which is the best way to present to the user a 2-categories-login-field?

I have a login screen that has two ways of authentication: via e-mail or a numeric code. So i'm wondering if i should make the user decide(use a tab-bar or a switch...) which kind of login auth he ...
user avatar
3 votes
2 answers
370 views

How to get around wanting to use email as unique login, but having existing users with multiple accounts per email?

I viewed Should multiple user accounts be allowed to use the same email address? My problem is that we're writing the new version of our website, but need to migrate the old user database to the new ...
user avatar
1 vote
1 answer
121 views

Button appears in two important locations and feels redundant

I'm building a log in page but ran into an issue with my nav bar. As you can see the "Log In" button appears in two locations. What's the best way to approach this? To me it looks odd to have it ...
user avatar
  • 13
4 votes
2 answers
196 views

What are the advantages of selfies for security?

A former client of us hired us again after 3 years. In that period, they had many changes, one of them the use of selfies for security reasons. I have found this type of security from time to time, ...
user avatar
  • 32.5k
1 vote
4 answers
2k views

How to Block Multiple Logins /Sign Up?

So, I have an App where the user needs to sign up to access the app. I'm planning to run an offer where user can order that item only once in a day. But I have the doubt that he may change login Id (...
user avatar
0 votes
1 answer
123 views

Automatical Button-Less Login

I'm working on a project where we want to setup a button-less login form. The idea is, if you enter your credentials correctly, you will get logged in automatically (don't have to press ENTER or ...
user avatar
  • 101
2 votes
4 answers
94 views

Will users tolerate starting over when their key identification is changed?

The main function of my app: Two users select each other by phone number Neither of them is aware of the other at the beginning Based on certain activities over time, an event happens for both Due ...
user avatar
  • 123
2 votes
1 answer
60 views

Example workflow when changing a site's identify provider

I'm switching a site from ADFS/AD to Azure B2C/AAD and require users to reset their password. Users will also see different log in screens. I'm struggling to find an approach where users won't be ...
user avatar
  • 125
0 votes
1 answer
111 views

Smartphone-only apps: consequences of limiting one account per phone number?

For smartphone-only apps that require each user to be a person (apps where there is no room for people to have multiple accounts), what are the negative consequences of limiting each phone number to ...
user avatar
2 votes
2 answers
916 views

Get the user to accept Terms & Conditions when signing up with OAuth

The register form I'm working on allows the user to sign up using their Facebook account or to create a new account by typing their email and password. Here a mockup: Currently, clicking on the ...
user avatar
2 votes
2 answers
204 views

Layman's term and description for 2-Step Verification process

Many of us are probably used to seeing or hearing the term 'Two factor authentication' or '2 Step Verification' process by now, although we are probably more familiar with the interaction involved (i....
user avatar
  • 25.3k
1 vote
4 answers
2k views

How to clearly distinguish a login page from a register page?

I recently conducted a series of user experience evaluation sessions for a prototype application that had been developed with the goal of capturing user experience bottlenecks and other issues. Each ...
user avatar
4 votes
1 answer
985 views

What is the proper way to change user email?

I could just put "Email:" field into "Edit profile" form (that is the form to edit current user information) of my site. But this way it is possible that a user both changes the email in a wrong way ...
user avatar
  • 171
0 votes
1 answer
165 views

Webpage behavior for an expired authentication referral link

I'm working on a Single Sign On service. An example use case I'm trying to solve is as follows: User A sends User B a link to www.exampleapp.com/resource/abc. This resource requires authentication ...
user avatar
1 vote
1 answer
5k views

Good UX practices for 2 factor authentication 2FA

I am designing a mobile app that must use two factor authentication. Do you know good practices or research in that field? One of my concerns is that non tech savvy users may get lost or confused if ...
user avatar
2 votes
2 answers
375 views

Is there a name for the UX pattern where you enter a code from an unauthenticated device on an authenticated one in order to login?

Several services such as YouTube, Plex, and XFINITY use a pattern in which an unauthenticated device displays a code for the user to enter on an authenticated device. When the user enters the code on ...
user avatar
  • 123
5 votes
8 answers
7k views

Verifying an account with SMS as opposed to email address

In order to be more secure we're looking into account verification. The two options are: Email address verification (Asking the user to click a link in an email sent to their account to verify the ...
user avatar
  • 593
1 vote
1 answer
104 views

Authenticating / Validating a user, from an email/SMS invite

I'm designing a system whereby a company creates accounts for it's customers and sends an invite via email/SMS. The system contains PII, so we need to be cautious with data security. We need a ...
user avatar
  • 11
1 vote
4 answers
6k views

What is the terminology for the page to which the user is redirected to, after successful login?

I did quite a search for this both online and offline, but couldn't find a satisfiable answer. Some of my colleagues suggested terminologies like Dashboard, Home page, Welcome page, landing page, etc. ...
user avatar
  • 111
4 votes
2 answers
610 views

Is Gmail verification really user friendly?

I want to access my gmail, but when I try to login in via the web it shows an alert "verify its you". In case if I lost my mobile or the phone is dead or network is down, I'm unable to verify the code ...
user avatar
  • 2,874
5 votes
4 answers
1k views

How to prevent creation of multiple accounts under the same company?

Let's say there's Company ABC and Employee A signed-up for an account under his own email address (e.g. employeeA@companyabc.com). However, let's say Employee B signed-up under the same company but ...
user avatar
  • 4,188
1 vote
2 answers
122 views

Presentation of public and private instances

In my application there exist publicly available and browsable objects. However, users are also able to register, authenticate and then author and manage their own personal instances of these same ...
user avatar
2 votes
1 answer
502 views

What is the best way to integrate OAuth into an existing authentication system?

I'm currently working on a project to integrate OAuth with a pre-existing, in-house auth system. We have uncovered a number of potential issues, and I'm surprised to find so little online about what I ...
user avatar
  • 131
3 votes
3 answers
781 views

Two factor authentication in a single form

We are working on implementing a Google two factor authentication in our app. Each customer can turn 2FA on and off for their users in app settings. There was an idea to tweak this functionality. We ...
user avatar
1 vote
3 answers
361 views

Giving user a preference to pick either TouchID or Pin login on iOS platform

As of iPhone5s we have technology like TouchID which is much secure way of authenticating user instead writing long complicated passwords. Although, we also have a pin login which does require minimal ...
user avatar
  • 13
2 votes
2 answers
2k views

What are the pro's and con's of an extended user session?

When having a portal where due to regulations, the content displayed inside must be accessed through user authentication (username / password). Are there best practices / pros and cons of having ...
user avatar
3 votes
5 answers
720 views

What happens when users are given a secret URL instead of a username/password?

I'm on the fence in regards to whether I should implement user accounts or secret URLs. There are pros and cons to both, and I'm currently leaning in favor of the secret URLs because of the simplicity:...
user avatar
  • 339
2 votes
1 answer
159 views

different pricing for new customers VS. existing customers

how would you go about showing different prices to different users? currently working on a mobile network's website, and its been requested to show different pricing depending on if the user is new ...
user avatar
2 votes
1 answer
196 views

When using embedded browser authentication, how can I increase user trust?

I have run into this situation before but I will speak specifically about a current project, since it is a good example. I am building a desktop application that uses the Stack Exchange API, and ...
user avatar
  • 2,612
1 vote
2 answers
105 views

App authentication providers

I'm in the early stages of developing a new Android app which will require authentication (data driven app using Firebase database with user specific data). I've considered authentication options and ...
user avatar
1 vote
3 answers
66 views

Best format and maximum length for manually typed authentication code

I need to send one-time codes with a relatively short expiration time (say 15 minutes). Potentially there may be hundreds of codes active at the same time. What are suggested formats for this? Any ...
user avatar
  • 133
1 vote
1 answer
55 views

For a closed off API, is not more friendly to have only a 'secret' - no 'username'?

Quite a few API's have something like a 'username' and a 'secret'. Is there anything against the decission to just work with a (generated) secret? Of course the secret should be long enough - GUID ...
user avatar
  • 935
0 votes
1 answer
50 views

Allow users to mark asset as "found" without account?

I have a website where a user can post something they are looking for and the ad gets distributed out to a public board (technically multiple) anyone can see. Up to this point (99% of the site) my ...
user avatar
  • 15.2k
1 vote
1 answer
135 views

Common email pitfalls for social login integrations

We are planning to implement social logins on our site. (Potentially via a service like Janrain or Auth0.) For us the user's email is key, so we will implement only services that expose the user's ...
user avatar
  • 113