Skip to main content

Questions tagged [authentication]

use this tag for questions related to authentication in the context of security

Filter by
Sorted by
Tagged with
71 votes
8 answers

How to tell a user their login credentials are incorrect?

When a user has entered incorrect details into a login form, is it better to tell them: The username or password you have entered is invalid. or The username you have entered is invalid (for ...
F21's user avatar
  • 5,908
79 votes
11 answers

Should users be allowed to use any special character they want when creating a password?

I came across a number of login configuration settings where there is a list of allowable special characters and was wondering: Does this limitation cater for a specific security or usability need? ...
Okavango's user avatar
  • 7,026
30 votes
6 answers

Forcing users to use a particular pattern for passwords

Many websites, specially government ones, enforce users to use a password which conforms to particular criteria. For example: use between 8-13 characters with at-least one integer and one capital ...
Salman Ehsan's user avatar
  • 4,951
6 votes
4 answers

Business application: Is it better to redirect or pop-up for re-authentication?

This question is geared for a line of business application someone would pay for, not a general public facing website. Is it better to redirect for authentication/re-authentication or show a pop-up? ...
rick schott's user avatar
  • 4,745
6 votes
10 answers

Is there any advantage of signup before login with social plugins?

I am building a site and was thinking about if there should be a signup option at all. I found the question about the difference between sign up and log in with Facebook/Google/etc but there was ...
nxshar2's user avatar
  • 113
4 votes
3 answers

Is offering more than one openid/social-sign-in option a good idea?

Lots of sites nowadays offer the option to log in via Google, Facebook, LinkedIn and so on, and sometimes a standard username/password option as well. While this goes a long way toward helping users ...
Assaf Lavie's user avatar
  • 1,886
21 votes
5 answers

Is a "Login Successful" Message Necessary?

On an informational/forum website (say, similar to a StackExchange site), is it necessary to show a "login successful" message? Clarification: On the site in question, the users can log in by ...
GWR's user avatar
  • 1,479
20 votes
5 answers

Whats more user friendly local authentication or remote authentication (OpenID, OAuth)

From a usability perspective only (not security), what do users find more comfortable? A site with its own login page (need to sign up but then easier to login; or a site with remote authentication (...
Sruly's user avatar
  • 3,552
14 votes
3 answers

Is it bad practice not to allow users to create an account (versus OAuth or OpenID)?

When creating a website is it poor practice not to give users the option to "create an account"? Especially with rapid development, it seems more secure with less effort to offload authentication. ...
ramblinjan's user avatar
12 votes
2 answers

Dealing with Connected Social Accounts and Potential Orphans

Our application has the following signup paths: Twitter Connect Facebook Connect Email/Password Once you signup with one, you have the option to connect either both social account (in the case of an ...
roomnoise's user avatar
  • 121
9 votes
4 answers

How many incorrect attempts should be allowed before invalidating a password?

I am trying to prevent brute force attacks on a user's account by invalidating a password when too many attempts are made in the same minute, hour, day or something similar. The credentials in this ...
Alexandre Martins's user avatar
9 votes
5 answers

Why would you, for a local authentication site, have usernames, instead of using e-mail address to login?

In websites where authentication is local, or mixed local and remote (e.g. OpenID), I still often see the question for a username. I can very well understand this in the case of twitter, where the ...
user avatar
5 votes
4 answers

How to prevent creation of multiple accounts under the same company?

Let's say there's Company ABC and Employee A signed-up for an account under his own email address (e.g. [email protected]). However, let's say Employee B signed-up under the same company but ...
catandmouse's user avatar
  • 4,278
4 votes
2 answers

How to request a third-party login within a seperate mobile application

I'm designing a mobile app that requires the user to log-in with their LinkedIn account. I feel I might have cluttered too much info into it, but everything seems to be important. I want the user to ...
Yosef Waysman's user avatar
0 votes
1 answer

Separators in user config screen (Polymer/material) [closed]

I managed to create a usable screen to manage credentials. It's a bit tricky, because users can set login/password pair, as well as Facebook. However, a user could have just facebook, just login/pass, ...
Merc's user avatar
  • 277