Questions tagged [authentication]
use this tag for questions related to authentication in the context of security
130
questions
78
votes
11
answers
26k
views
Should users be allowed to use any special character they want when creating a password?
I came across a number of login configuration settings where there is a list of allowable special characters and was wondering:
Does this limitation cater for a specific security or usability need?
...
- 6,996
70
votes
8
answers
80k
views
How to tell a user their login credentials are incorrect?
When a user has entered incorrect details into a login form, is it better to tell them:
The username or password you have entered is invalid.
or
The username you have entered is invalid (for ...
- 5,888
30
votes
6
answers
3k
views
Forcing users to use a particular pattern for passwords
Many websites, specially government ones, enforce users to use a password which conforms to particular criteria. For example: use between 8-13 characters with at-least one integer and one capital ...
- 4,941
26
votes
11
answers
11k
views
How to ensure users can't sign up for multiple accounts?
I'm working on a web app right now which users will normally have to pay to use, but I want to also offer a short demo period (haven't settled on how long yet, but somewhere between 1 day and 1 week).
...
- 607
22
votes
2
answers
2k
views
What's better for invitation emails: a temporary password or a one-time login url?
Our web app allows our customers to invite their collaborators into their account. They can submit the new user's email address, and our app sends the new user an email inviting them to login. Once ...
- 2,227
21
votes
5
answers
33k
views
Is a "Login Successful" Message Necessary?
On an informational/forum website (say, similar to a StackExchange site), is it necessary to show a "login successful" message?
Clarification: On the site in question, the users can log in by ...
- 1,479
20
votes
5
answers
3k
views
Whats more user friendly local authentication or remote authentication (OpenID, OAuth)
From a usability perspective only (not security), what do users find more comfortable?
A site with its own login page (need to sign up but then easier to login;
or a site with remote authentication (...
- 3,532
17
votes
5
answers
3k
views
Should I use two steps or one when users change password?
I currently have a page dedicated to changing passwords. There are 2 options:
A 2 step option:
download bmml source – Wireframes created with Balsamiq Mockups
download bmml source
A 1 step ...
- 5,888
17
votes
3
answers
9k
views
social sign in redirect vs popup window
I have seen that most websites usually open the "login with Facebook" page in a popup window, but there are also some websites (like stackexchange) that just redirect the browser without opening a ...
- 337
15
votes
7
answers
11k
views
Should my app send a confirmation email on user registration?
I'm grappling with the user registration experience for my application.
I'm considering this model:
User enters...
Username
Password
Password confirmation
Email address
The app displays a message ...
- 251
14
votes
6
answers
976
views
What is the best way to request individual characters from a password?
Frequently, sites that should really value security (especially banks) ask for several individual characters from a password.
Typically I've seen them do it like this:
download bmml source – ...
- 389
14
votes
3
answers
2k
views
Is it bad practice not to allow users to create an account (versus OAuth or OpenID)?
When creating a website is it poor practice not to give users the option to "create an account"? Especially with rapid development, it seems more secure with less effort to offload authentication. ...
- 529
12
votes
2
answers
757
views
Dealing with Connected Social Accounts and Potential Orphans
Our application has the following signup paths:
Twitter Connect
Facebook Connect
Email/Password
Once you signup with one, you have the option to connect either both social account (in the case of an ...
- 121
9
votes
4
answers
18k
views
How do I best tell a user that his/her account will be locked if they enter the wrong credentials too many times?
We are going to add an additional layer of security to our product by locking user accounts for a short period of time (configurable in the product, but probably 5-10 minutes) when a user has tried to ...
- 191
9
votes
5
answers
1k
views
Why would you, for a local authentication site, have usernames, instead of using e-mail address to login?
In websites where authentication is local, or mixed local and remote (e.g. OpenID), I still often see the question for a username. I can very well understand this in the case of twitter, where the ...
user745
9
votes
4
answers
7k
views
How many incorrect attempts should be allowed before invalidating a password?
I am trying to prevent brute force attacks on a user's account by invalidating a password when too many attempts are made in the same minute, hour, day or something similar. The credentials in this ...
8
votes
2
answers
506
views
Masked password characters in a GUI vs terminal
In a GUI form, or for example a login box on a website, it's usual for masked characters to appear like ********* as you type out your password.
But in terminal applications, for example ssh, this ...
- 327
7
votes
4
answers
5k
views
Password validation in login form
In registration form, I have client side validation for strength of password. For example password should be not less than 6 symbols, consists at least 1 digit, and at least 1 letter.
For example: ...
- 375
7
votes
2
answers
914
views
What is the correct tab-indexing for a log-in form with a "forgot password" link?
I have a login form shown below, and I am trying to figure out the correct tabbing for it for the best accessibility and user-experience. This seems like a very common design, but I haven't found a ...
user31914
7
votes
6
answers
2k
views
Can users login and register via the same form?
In designing my project I've toyed with having the login and registration in the same form. The inputs for the details needed to login would be there initially, and if the user presses the register ...
- 180
6
votes
10
answers
6k
views
Is there any advantage of signup before login with social plugins?
I am building a site and was thinking about if there should be a signup option at all.
I found the question about the difference between sign up and log in with Facebook/Google/etc but there was ...
- 113
6
votes
4
answers
863
views
Business application: Is it better to redirect or pop-up for re-authentication?
This question is geared for a line of business application someone would pay for, not a general public facing website.
Is it better to redirect for authentication/re-authentication or show a pop-up?
...
- 4,725
6
votes
7
answers
1k
views
What is the best mobile number authorization strategy?
In recent years, mobile number has become an important factor for authentication and hence more and more enterprises employ methods to capture their users' mobile numbers using SMS.
In a typical ...
- 105
6
votes
2
answers
544
views
How can I encourage users to authenticate?
I am working on a post-sale customer support project for a US high street retailer (for the rest of this post I will refer to them as 'Jon's Cellphones'). The program will enable customers who ...
- 1,798
6
votes
1
answer
142
views
What OpenID log-in screen is appropriate for people who don't understand SAML, OpenID, or Federation?
Every person that I've introduced to Stackexchange has had the same question/problem... that is they are confused by options to log using "gmail" or "hotmail" and assume that this is an email ...
- 1,028
5
votes
4
answers
356
views
Logging in with email only
I'm working on a blog and there will be an option to post a comment.
I could implement registration with username, password and email — the standard way. I could implement 3rd-party authorization ...
- 151
5
votes
8
answers
7k
views
Verifying an account with SMS as opposed to email address
In order to be more secure we're looking into account verification. The two options are:
Email address verification (Asking the user to click a link in an email sent to their account to verify the ...
- 593
5
votes
1
answer
203
views
How important is social sign-up to attracting new users?
Many website, including this one, are using social sign-up to speed up new user registrations. I'd like to know what are the adoption rates of this service, and whether there are any pitfalls to using ...
- 681
5
votes
5
answers
197
views
Validation without an explicit confirmation
I am currently working on an app. This app has some features that the user can unlock by entering a numeric code.
I was considering putting an automatic validation as soon as the user types the last ...
- 95
5
votes
4
answers
1k
views
Biometrics Activated UI
I'm having a problem regarding a user interface with bio-metrics inter action in employee logging in/out. The employee needs to choose whether he/she will login or logout and enter his/her employee ...
- 1,605
5
votes
4
answers
1k
views
How to prevent creation of multiple accounts under the same company?
Let's say there's Company ABC and Employee A signed-up for an account under his own email address (e.g. [email protected]). However, let's say Employee B signed-up under the same company but ...
- 4,228
5
votes
1
answer
2k
views
What percent of Android users with fingerprint enabled phones use the fingerprint feature?
We recently added Android fingerprint authentication to our app. Currently, only 51% of users who have seen the fingerprint prompt have enabled the feature. I'm not sure if the number is low due to ...
5
votes
2
answers
217
views
Mobile application without direct authorization \ registration
UX \ UI professionals. The question connects both the user experience and data security.
We are going to build the app, where the user is going to pay for the services.
He should enter his email, ...
- 151
4
votes
6
answers
586
views
Is there a way to disallow multiple votes from one user without forcing authentication? [closed]
I'm looking for a way to prohibit voting rigging (cache/cookie-clearing, etc.) without requiring the user to jump through hoops (registration, authentication, etc.). Any ideas?
- 889
4
votes
1
answer
1k
views
What is the proper way to change user email?
I could just put "Email:" field into "Edit profile" form (that is the form to edit current user information) of my site.
But this way it is possible that a user both changes the email in a wrong way ...
- 171
4
votes
3
answers
4k
views
Facebook/Twitter login only vs. Facebook/Twitter signup and login separately
I have searched for this topic here, but haven't found solid answers for the problem.
So the situation is this: we are creating the authentication screens for a mobile app and we are not sure which ...
- 188
4
votes
2
answers
218
views
How to ask for a user's identity?
My company is working on an internal phone application to be used by many users that requires authentication. Based on historical data, we can assume the likelihood of a user's identity at a given ...
- 360
4
votes
3
answers
549
views
Is offering more than one openid/social-sign-in option a good idea?
Lots of sites nowadays offer the option to log in via Google, Facebook, LinkedIn and so on, and sometimes a standard username/password option as well.
While this goes a long way toward helping users ...
- 1,886
4
votes
2
answers
2k
views
Should I verify e-mail format in login form?
My B2B web app's login form has an email and password field.
So far, I'm only checking if the fields are empty. I then make my authentication request, if there's a problem I return only one kind of ...
- 509
4
votes
2
answers
672
views
What is the best way to notify a user he doesn't have an account
As a helpdesk engineer I'm offering support on a rather big Belgian E-commerce website.
While we have a vast number of users there are also many users whose account is deleted automatically after 1 ...
- 346
4
votes
2
answers
226
views
How to request a third-party login within a seperate mobile application
I'm designing a mobile app that requires the user to log-in with their LinkedIn account.
I feel I might have cluttered too much info into it, but everything seems to be important.
I want the user to ...
- 4,487
4
votes
2
answers
469
views
How to get around wanting to use email as unique login, but having existing users with multiple accounts per email?
I viewed
Should multiple user accounts be allowed to use the same email address?
My problem is that we're writing the new version of our website, but need to migrate the old user database to the new ...
4
votes
2
answers
207
views
What are the advantages of selfies for security?
A former client of us hired us again after 3 years. In that period, they had many changes, one of them the use of selfies for security reasons.
I have found this type of security from time to time, ...
- 36.5k
4
votes
1
answer
145
views
How to explain the concept of choosing password to user
We have an online store application that uses one-time passwords for user login. The user enters her email address, and we email her a one-time password to log in with.
She doesn't choose any ...
- 193
4
votes
2
answers
636
views
Is Gmail verification really user friendly?
I want to access my gmail, but when I try to login in via the web it shows an alert "verify its you". In case if I lost my mobile or the phone is dead or network is down, I'm unable to verify the code ...
- 2,924
4
votes
1
answer
637
views
What is the proper way to provide social media authentication: in login or register form?
We provided standard login/registration forms for providing email and password, but I'd also like to allow user use my website after oAuth authentication.
Should they be able to register or login via ...
- 143
3
votes
3
answers
786
views
Forcing users to use a new password everytime they reset
This is getting common that while resetting one's password, web-applications force users not to use a password which they had used before. Just like forcing users to follow a particular pattern of ...
- 4,941
3
votes
4
answers
1k
views
Correct UX for the scenario when a user forgets the answers to their security questions?
We have an application where a user is required upon registration to set up three security questions and answers
When they login to the application, they must answer one of the questions after ...
- 183
3
votes
2
answers
2k
views
Best practice for two-factor authentication process
Perhaps due to the recent incidents behind hacking of user database and identity theft, many organizations have introduced the two-factor authentication process, in particular when users are accessing ...
- 26.5k
3
votes
2
answers
225
views
Authentication frequency for polling system
I am building a system to be used for polling during an election. Security is a massive issue as I'm sure you understand!
We are using two factor authentication so the user will be asked to supply a ...
- 8,250