Questions tagged [authentication]
use this tag for questions related to authentication in the context of security
131
questions
1
vote
2
answers
47
views
What should the default 2FA method be for a user opening an account?
Our application (investment solution) asks users to set up a 2FA method after setting their password during onboarding.
We offer multiple methods of 2FA; memorable questions, text message security, ...
2
votes
3
answers
100
views
Does onboarding include sign up?
I'm designing a matchmaking platform for influencers and marketers. I want to create a secure platform that verifies identities (both influencers, and marketers that work for legit brands).
I am ...
2
votes
2
answers
2k
views
Get the user to accept Terms & Conditions when signing up with OAuth
The register form I'm working on allows the user to sign up using their Facebook account or to create a new account by typing their email and password. Here a mockup:
Currently, clicking on the ...
CommunityBot
- 1
1
vote
2
answers
152
views
Is a process secure if it's not perceived as such?
We just finished research for an article on 2FA (Two-Factor Authentication) and, while writing the report on the insights, I got wondering on this particular finding: Our research indicates that most ...
- 11.4k
2
votes
1
answer
127
views
How to design interactions for guiding users to install an application during sign up process
Application objective
We have a mobile application where a sales employee will be able to login to see his sales stats for the month. The data available to the employee is restricted to only his own ...
- 1,013
7
votes
6
answers
2k
views
Can users login and register via the same form?
In designing my project I've toyed with having the login and registration in the same form. The inputs for the details needed to login would be there initially, and if the user presses the register ...
- 4,481
2
votes
1
answer
69
views
Should authenticated users still see the app's public home page
Let's take two examples:
GitHub → the public page at github.com is a presentation of GitHub's features. Once a user is logged in, he never sees this home page again: github.com become the user's ...
- 1,682
21
votes
5
answers
34k
views
Is a "Login Successful" Message Necessary?
On an informational/forum website (say, similar to a StackExchange site), is it necessary to show a "login successful" message?
Clarification: On the site in question, the users can log in by ...
2
votes
1
answer
288
views
iOS apps log users out when upgrading to a new phone
Why do so many apps log users out after upgrading to a new phone ? (ex: Gmail, Slack, Instagram).
From a technical POV it's easy to keep the user logged in after a phone upgrade.
Is there any upside ...
- 459
1
vote
4
answers
2k
views
How to Block Multiple Logins /Sign Up?
So, I have an App where the user needs to sign up to access the app.
I'm planning to run an offer where user can order that item only once in a day.
But I have the doubt that he may change login Id (...
CommunityBot
- 1
9
votes
4
answers
7k
views
How many incorrect attempts should be allowed before invalidating a password?
I am trying to prevent brute force attacks on a user's account by invalidating a password when too many attempts are made in the same minute, hour, day or something similar. The credentials in this ...
- 19.5k
0
votes
1
answer
40
views
Whats the best approach to restoring access to a user who can't access their email?
I'm trying to think of different methods to restore an account to a user who can no longer access their email. For my project, regaining account access is very important, throwing away an account is ...
- 4,518
4
votes
1
answer
2k
views
What is the proper way to change user email?
I could just put "Email:" field into "Edit profile" form (that is the form to edit current user information) of my site.
But this way it is possible that a user both changes the email in a wrong way ...
JonW♦
- 37.2k
0
votes
2
answers
255
views
2FA into the login page (without email or phone number)
I have a question regarding UX of the 2nd factor authentication (2FA) process.
It is common in the authentication process to ask for user id (commonly email) + password, and in a second step ask for ...
- 111
70
votes
8
answers
81k
views
How to tell a user their login credentials are incorrect?
When a user has entered incorrect details into a login form, is it better to tell them:
The username or password you have entered is invalid.
or
The username you have entered is invalid (for ...
- 12.1k
7
votes
2
answers
949
views
What is the correct tab-indexing for a log-in form with a "forgot password" link?
I have a login form shown below, and I am trying to figure out the correct tabbing for it for the best accessibility and user-experience. This seems like a very common design, but I haven't found a ...
- 1
0
votes
3
answers
2k
views
Good UX for validating both phone and email
A website requires users to validate their email – it's how the user receives their password creation link, and email is essential to several core workflows.
There is now also a need to collect and ...
- 2,205
5
votes
8
answers
7k
views
Verifying an account with SMS as opposed to email address
In order to be more secure we're looking into account verification. The two options are:
Email address verification (Asking the user to click a link in an email sent to their account to verify the ...
1
vote
1
answer
97
views
How would you visualize authorization deviation with 90+ rules?
Users can preselect an authorization set (1). And, later on, modify the set. As a user, I want to see how the original authorization set differs from the one I changed. So I can see which ...
- 26.7k
3
votes
1
answer
81
views
Evolution of authentication-based navigation
Consider the case where an unauthenticated user sees a main navigation with a few items:
In the old days, someone with admin privileges might log in and simply see additional items exclusive to their ...
- 865
1
vote
1
answer
69
views
Quantifying the impact of offering alternative signup/login methods?
Nowadays it's common for websites to offer signup/signin methods that don't require making an account (email/password) for that specific site, for example 'Login with x':
Facebook
Google
Twitter
...
5
votes
5
answers
223
views
Validation without an explicit confirmation
I am currently working on an app. This app has some features that the user can unlock by entering a numeric code.
I was considering putting an automatic validation as soon as the user types the last ...
- 2,816
2
votes
1
answer
274
views
Should users be given a way to link a password after social auth?
Obviously it is very common for sites to allow log in using both the traditional email/password as well as social authentication using Facebook, Google, Twitter etc.
If a user creates an account using ...
CommunityBot
- 1
3
votes
2
answers
2k
views
Best practice for two-factor authentication process
Perhaps due to the recent incidents behind hacking of user database and identity theft, many organizations have introduced the two-factor authentication process, in particular when users are accessing ...
- 228
0
votes
2
answers
57
views
How many times should an unverified user be allowed to post on a social site?
If you allowed user to post content on social media site prior to verifying email, in order to increase conversions, how many times should he be allowed to do so?
What anti-spam measures you can put ...
- 12.1k
1
vote
1
answer
253
views
User signs up using their Facebook account logs and then logs in with their (same email) Google account. Now what?
Our web app (a personal calendar-management tool) offers both Facebook and Google as social login providers. Sometimes a user who originally signed up using a Facebook account tries to log in using ...
- 31
0
votes
1
answer
247
views
Best way to suggest enabling cross-site cookies with Brave
For technical reasons (OIDC library uses CORS requests to renew API access tokens), our application requires that when using the Brave browser, the security shields built into Brave be either disabled ...
- 658
1
vote
2
answers
250
views
What would be the success criteria for user testing for 2FA authentication
i'm conducting a user testing session for a few prototypes. one of the prototypes of a feature i'll be testing is the 2 factor authentication.
Compared to other features which have more of an ...
- 353
0
votes
4
answers
272
views
At what step in the user flow of a travel booking app would 2FA OTP be needed
i'm designing a 2FA OPT feature for an app that lets users book flights and trains. As users are able to store personal information including their payment details, this level of verification is ...
CommunityBot
- 1
1
vote
4
answers
10k
views
What is the terminology for the page to which the user is redirected to, after successful login?
I did quite a search for this both online and offline, but couldn't find a satisfiable answer. Some of my colleagues suggested terminologies like Dashboard, Home page, Welcome page, landing page, etc. ...
- 759
0
votes
1
answer
39
views
Which is the best way to present to the user a 2-categories-login-field?
I have a login screen that has two ways of authentication: via e-mail or a numeric code.
So i'm wondering if i should make the user decide(use a tab-bar or a switch...) which kind of login auth he ...
- 632
4
votes
2
answers
484
views
How to get around wanting to use email as unique login, but having existing users with multiple accounts per email?
I viewed
Should multiple user accounts be allowed to use the same email address?
My problem is that we're writing the new version of our website, but need to migrate the old user database to the new ...
CommunityBot
- 1
1
vote
1
answer
125
views
Button appears in two important locations and feels redundant
I'm building a log in page but ran into an issue with my nav bar. As you can see the "Log In" button appears in two locations.
What's the best way to approach this? To me it looks odd to have it ...
- 6,799
4
votes
2
answers
207
views
What are the advantages of selfies for security?
A former client of us hired us again after 3 years. In that period, they had many changes, one of them the use of selfies for security reasons.
I have found this type of security from time to time, ...
- 2,655
3
votes
3
answers
906
views
Two factor authentication in a single form
We are working on implementing a Google two factor authentication in our app. Each customer can turn 2FA on and off for their users in app settings.
There was an idea to tweak this functionality. We ...
CommunityBot
- 1
0
votes
1
answer
134
views
Automatical Button-Less Login
I'm working on a project where we want to setup a button-less login form.
The idea is, if you enter your credentials correctly, you will get logged in automatically (don't have to press ENTER or ...
- 4,481
20
votes
5
answers
3k
views
Whats more user friendly local authentication or remote authentication (OpenID, OAuth)
From a usability perspective only (not security), what do users find more comfortable?
A site with its own login page (need to sign up but then easier to login;
or a site with remote authentication (...
- 4,481
15
votes
7
answers
11k
views
Should my app send a confirmation email on user registration?
I'm grappling with the user registration experience for my application.
I'm considering this model:
User enters...
Username
Password
Password confirmation
Email address
The app displays a message ...
- 4,481
3
votes
4
answers
1k
views
Correct UX for the scenario when a user forgets the answers to their security questions?
We have an application where a user is required upon registration to set up three security questions and answers
When they login to the application, they must answer one of the questions after ...
- 193
2
votes
4
answers
95
views
Will users tolerate starting over when their key identification is changed?
The main function of my app:
Two users select each other by phone number
Neither of them is aware of the other at the beginning
Based on certain activities over time, an event happens for both
Due ...
CommunityBot
- 1
2
votes
1
answer
70
views
Example workflow when changing a site's identify provider
I'm switching a site from ADFS/AD to Azure B2C/AAD and require users to reset their password. Users will also see different log in screens. I'm struggling to find an approach where users won't be ...
- 389
0
votes
1
answer
151
views
Smartphone-only apps: consequences of limiting one account per phone number?
For smartphone-only apps that require each user to be a person (apps where there is no room for people to have multiple accounts), what are the negative consequences of limiting each phone number to ...
- 3,310
78
votes
11
answers
26k
views
Should users be allowed to use any special character they want when creating a password?
I came across a number of login configuration settings where there is a list of allowable special characters and was wondering:
Does this limitation cater for a specific security or usability need?
...
- 515
2
votes
2
answers
301
views
Layman's term and description for 2-Step Verification process
Many of us are probably used to seeing or hearing the term 'Two factor authentication' or '2 Step Verification' process by now, although we are probably more familiar with the interaction involved (i....
5
votes
4
answers
1k
views
How to prevent creation of multiple accounts under the same company?
Let's say there's Company ABC and Employee A signed-up for an account under his own email address (e.g. [email protected]). However, let's say Employee B signed-up under the same company but ...
- 669
0
votes
1
answer
276
views
Separators in user config screen (Polymer/material) [closed]
I managed to create a usable screen to manage credentials. It's a bit tricky, because users can set login/password pair, as well as Facebook. However, a user could have just facebook, just login/pass, ...
CommunityBot
- 1
5
votes
2
answers
219
views
Mobile application without direct authorization \ registration
UX \ UI professionals. The question connects both the user experience and data security.
We are going to build the app, where the user is going to pay for the services.
He should enter his email, ...
CommunityBot
- 1
26
votes
11
answers
11k
views
How to ensure users can't sign up for multiple accounts?
I'm working on a web app right now which users will normally have to pay to use, but I want to also offer a short demo period (haven't settled on how long yet, but somewhere between 1 day and 1 week).
...
CommunityBot
- 1
1
vote
4
answers
3k
views
How to clearly distinguish a login page from a register page?
I recently conducted a series of user experience evaluation sessions for a prototype application that had been developed with the goal of capturing user experience bottlenecks and other issues.
Each ...
- 4,481
4
votes
3
answers
4k
views
Facebook/Twitter login only vs. Facebook/Twitter signup and login separately
I have searched for this topic here, but haven't found solid answers for the problem.
So the situation is this: we are creating the authentication screens for a mobile app and we are not sure which ...
- 1