Questions tagged [authentication]

confirmation that a user is who they claim to be, either by verifying what they know (password), what they have (a key) or what they are (fingerprints).

Filter by
Sorted by
Tagged with
70 votes
8 answers
77k views

How to tell a user their login credentials are incorrect?

When a user has entered incorrect details into a login form, is it better to tell them: The username or password you have entered is invalid. or The username you have entered is invalid (for ...
user avatar
  • 5,808
77 votes
11 answers
25k views

Should users be allowed to use any special character they want when creating a password?

I came across a number of login configuration settings where there is a list of allowable special characters and was wondering: Does this limitation cater for a specific security or usability need? ...
user avatar
  • 6,976
30 votes
6 answers
3k views

Forcing users to use a particular pattern for passwords

Many websites, specially government ones, enforce users to use a password which conforms to particular criteria. For example: use between 8-13 characters with at-least one integer and one capital ...
user avatar
  • 4,931
6 votes
4 answers
697 views

Business application: Is it better to redirect or pop-up for re-authentication?

This question is geared for a line of business application someone would pay for, not a general public facing website. Is it better to redirect for authentication/re-authentication or show a pop-up? ...
user avatar
  • 4,705
6 votes
10 answers
5k views

Is there any advantage of signup before login with social plugins?

I am building a site and was thinking about if there should be a signup option at all. I found the question about the difference between sign up and log in with Facebook/Google/etc but there was ...
user avatar
4 votes
3 answers
536 views

Is offering more than one openid/social-sign-in option a good idea?

Lots of sites nowadays offer the option to log in via Google, Facebook, LinkedIn and so on, and sometimes a standard username/password option as well. While this goes a long way toward helping users ...
user avatar
  • 1,876
20 votes
5 answers
2k views

Whats more user friendly local authentication or remote authentication (OpenID, OAuth)

From a usability perspective only (not security), what do users find more comfortable? A site with its own login page (need to sign up but then easier to login; or a site with remote authentication (...
user avatar
  • 3,532
21 votes
5 answers
29k views

Is a "Login Successful" Message Necessary?

On an informational/forum website (say, similar to a StackExchange site), is it necessary to show a "login successful" message? Clarification: On the site in question, the users can log in by ...
user avatar
  • 1,479
8 votes
4 answers
6k views

How many incorrect attempts should be allowed before invalidating a password?

I am trying to prevent brute force attacks on a user's account by invalidating a password when too many attempts are made in the same minute, hour, day or something similar. The credentials in this ...
user avatar
12 votes
2 answers
644 views

Dealing with Connected Social Accounts and Potential Orphans

Our application has the following signup paths: Twitter Connect Facebook Connect Email/Password Once you signup with one, you have the option to connect either both social account (in the case of an ...
user avatar
  • 121
10 votes
5 answers
1k views

Why would you, for a local authentication site, have usernames, instead of using e-mail address to login?

In websites where authentication is local, or mixed local and remote (e.g. OpenID), I still often see the question for a username. I can very well understand this in the case of twitter, where the ...
user avatar
14 votes
3 answers
2k views

Is it bad practice not to allow users to create an account (versus OAuth or OpenID)?

When creating a website is it poor practice not to give users the option to "create an account"? Especially with rapid development, it seems more secure with less effort to offload authentication. ...
user avatar
5 votes
4 answers
1k views

How to prevent creation of multiple accounts under the same company?

Let's say there's Company ABC and Employee A signed-up for an account under his own email address (e.g. employeeA@companyabc.com). However, let's say Employee B signed-up under the same company but ...
user avatar
  • 4,188
4 votes
2 answers
220 views

How to request a third-party login within a seperate mobile application

I'm designing a mobile app that requires the user to log-in with their LinkedIn account. I feel I might have cluttered too much info into it, but everything seems to be important. I want the user to ...
user avatar
0 votes
1 answer
263 views

Separators in user config screen (Polymer/material) [closed]

I managed to create a usable screen to manage credentials. It's a bit tricky, because users can set login/password pair, as well as Facebook. However, a user could have just facebook, just login/pass, ...
user avatar
  • 277