Skip to main content

Questions tagged [authentication]

use this tag for questions related to authentication in the context of security

Filter by
Sorted by
Tagged with
2 votes
2 answers
2k views

Get the user to accept Terms & Conditions when signing up with OAuth

The register form I'm working on allows the user to sign up using their Facebook account or to create a new account by typing their email and password. Here a mockup: Currently, clicking on the ...
2 votes
2 answers
64 views

What should the default 2FA method be for a user opening an account?

Our application (investment solution) asks users to set up a 2FA method after setting their password during onboarding. We offer multiple methods of 2FA; memorable questions, text message security, ...
2 votes
3 answers
105 views

Does onboarding include sign up?

I'm designing a matchmaking platform for influencers and marketers. I want to create a secure platform that verifies identities (both influencers, and marketers that work for legit brands). I am ...
2 votes
2 answers
156 views

Is a process secure if it's not perceived as such?

We just finished research for an article on 2FA (Two-Factor Authentication) and, while writing the report on the insights, I got wondering on this particular finding: Our research indicates that most ...
2 votes
1 answer
130 views

How to design interactions for guiding users to install an application during sign up process

Application objective We have a mobile application where a sales employee will be able to login to see his sales stats for the month. The data available to the employee is restricted to only his own ...
7 votes
6 answers
2k views

Can users login and register via the same form?

In designing my project I've toyed with having the login and registration in the same form. The inputs for the details needed to login would be there initially, and if the user presses the register ...
2 votes
1 answer
80 views

Should authenticated users still see the app's public home page

Let's take two examples: GitHub → the public page at github.com is a presentation of GitHub's features. Once a user is logged in, he never sees this home page again: github.com become the user's ...
21 votes
5 answers
36k views

Is a "Login Successful" Message Necessary?

On an informational/forum website (say, similar to a StackExchange site), is it necessary to show a "login successful" message? Clarification: On the site in question, the users can log in by ...
2 votes
1 answer
406 views

iOS apps log users out when upgrading to a new phone

Why do so many apps log users out after upgrading to a new phone ? (ex: Gmail, Slack, Instagram). From a technical POV it's easy to keep the user logged in after a phone upgrade. Is there any upside ...
1 vote
4 answers
2k views

How to Block Multiple Logins /Sign Up?

So, I have an App where the user needs to sign up to access the app. I'm planning to run an offer where user can order that item only once in a day. But I have the doubt that he may change login Id (...
9 votes
4 answers
8k views

How many incorrect attempts should be allowed before invalidating a password?

I am trying to prevent brute force attacks on a user's account by invalidating a password when too many attempts are made in the same minute, hour, day or something similar. The credentials in this ...
0 votes
1 answer
44 views

Whats the best approach to restoring access to a user who can't access their email?

I'm trying to think of different methods to restore an account to a user who can no longer access their email. For my project, regaining account access is very important, throwing away an account is ...
5 votes
1 answer
2k views

What is the proper way to change user email?

I could just put "Email:" field into "Edit profile" form (that is the form to edit current user information) of my site. But this way it is possible that a user both changes the email in a wrong way ...
0 votes
2 answers
273 views

2FA into the login page (without email or phone number)

I have a question regarding UX of the 2nd factor authentication (2FA) process. It is common in the authentication process to ask for user id (commonly email) + password, and in a second step ask for ...
72 votes
8 answers
82k views

How to tell a user their login credentials are incorrect?

When a user has entered incorrect details into a login form, is it better to tell them: The username or password you have entered is invalid. or The username you have entered is invalid (for ...
7 votes
2 answers
1k views

What is the correct tab-indexing for a log-in form with a "forgot password" link?

I have a login form shown below, and I am trying to figure out the correct tabbing for it for the best accessibility and user-experience. This seems like a very common design, but I haven't found a ...
1 vote
3 answers
2k views

Good UX for validating both phone and email

A website requires users to validate their email – it's how the user receives their password creation link, and email is essential to several core workflows. There is now also a need to collect and ...
6 votes
8 answers
8k views

Verifying an account with SMS as opposed to email address

In order to be more secure we're looking into account verification. The two options are: Email address verification (Asking the user to click a link in an email sent to their account to verify the ...
1 vote
1 answer
99 views

How would you visualize authorization deviation with 90+ rules?

Users can preselect an authorization set (1). And, later on, modify the set. As a user, I want to see how the original authorization set differs from the one I changed. So I can see which ...
3 votes
1 answer
83 views

Evolution of authentication-based navigation

Consider the case where an unauthenticated user sees a main navigation with a few items: In the old days, someone with admin privileges might log in and simply see additional items exclusive to their ...
1 vote
1 answer
70 views

Quantifying the impact of offering alternative signup/login methods?

Nowadays it's common for websites to offer signup/signin methods that don't require making an account (email/password) for that specific site, for example 'Login with x': Facebook Google Twitter ...
5 votes
5 answers
300 views

Validation without an explicit confirmation

I am currently working on an app. This app has some features that the user can unlock by entering a numeric code. I was considering putting an automatic validation as soon as the user types the last ...
2 votes
1 answer
333 views

Should users be given a way to link a password after social auth?

Obviously it is very common for sites to allow log in using both the traditional email/password as well as social authentication using Facebook, Google, Twitter etc. If a user creates an account using ...
3 votes
2 answers
2k views

Best practice for two-factor authentication process

Perhaps due to the recent incidents behind hacking of user database and identity theft, many organizations have introduced the two-factor authentication process, in particular when users are accessing ...
0 votes
2 answers
57 views

How many times should an unverified user be allowed to post on a social site?

If you allowed user to post content on social media site prior to verifying email, in order to increase conversions, how many times should he be allowed to do so? What anti-spam measures you can put ...
1 vote
1 answer
257 views

User signs up using their Facebook account logs and then logs in with their (same email) Google account. Now what?

Our web app (a personal calendar-management tool) offers both Facebook and Google as social login providers. Sometimes a user who originally signed up using a Facebook account tries to log in using ...
0 votes
1 answer
257 views

Best way to suggest enabling cross-site cookies with Brave

For technical reasons (OIDC library uses CORS requests to renew API access tokens), our application requires that when using the Brave browser, the security shields built into Brave be either disabled ...
1 vote
2 answers
267 views

What would be the success criteria for user testing for 2FA authentication

i'm conducting a user testing session for a few prototypes. one of the prototypes of a feature i'll be testing is the 2 factor authentication. Compared to other features which have more of an ...
0 votes
4 answers
280 views

At what step in the user flow of a travel booking app would 2FA OTP be needed

i'm designing a 2FA OPT feature for an app that lets users book flights and trains. As users are able to store personal information including their payment details, this level of verification is ...
1 vote
4 answers
12k views

What is the terminology for the page to which the user is redirected to, after successful login?

I did quite a search for this both online and offline, but couldn't find a satisfiable answer. Some of my colleagues suggested terminologies like Dashboard, Home page, Welcome page, landing page, etc. ...
0 votes
1 answer
40 views

Which is the best way to present to the user a 2-categories-login-field?

I have a login screen that has two ways of authentication: via e-mail or a numeric code. So i'm wondering if i should make the user decide(use a tab-bar or a switch...) which kind of login auth he ...
5 votes
2 answers
516 views

How to get around wanting to use email as unique login, but having existing users with multiple accounts per email?

I viewed Should multiple user accounts be allowed to use the same email address? My problem is that we're writing the new version of our website, but need to migrate the old user database to the new ...
1 vote
1 answer
129 views

Button appears in two important locations and feels redundant

I'm building a log in page but ran into an issue with my nav bar. As you can see the "Log In" button appears in two locations. What's the best way to approach this? To me it looks odd to have it ...
4 votes
2 answers
210 views

What are the advantages of selfies for security?

A former client of us hired us again after 3 years. In that period, they had many changes, one of them the use of selfies for security reasons. I have found this type of security from time to time, ...
3 votes
3 answers
934 views

Two factor authentication in a single form

We are working on implementing a Google two factor authentication in our app. Each customer can turn 2FA on and off for their users in app settings. There was an idea to tweak this functionality. We ...
0 votes
1 answer
136 views

Automatical Button-Less Login

I'm working on a project where we want to setup a button-less login form. The idea is, if you enter your credentials correctly, you will get logged in automatically (don't have to press ENTER or ...
20 votes
5 answers
3k views

Whats more user friendly local authentication or remote authentication (OpenID, OAuth)

From a usability perspective only (not security), what do users find more comfortable? A site with its own login page (need to sign up but then easier to login; or a site with remote authentication (...
15 votes
7 answers
11k views

Should my app send a confirmation email on user registration?

I'm grappling with the user registration experience for my application. I'm considering this model: User enters... Username Password Password confirmation Email address The app displays a message ...
3 votes
4 answers
1k views

Correct UX for the scenario when a user forgets the answers to their security questions?

We have an application where a user is required upon registration to set up three security questions and answers When they login to the application, they must answer one of the questions after ...
2 votes
4 answers
95 views

Will users tolerate starting over when their key identification is changed?

The main function of my app: Two users select each other by phone number Neither of them is aware of the other at the beginning Based on certain activities over time, an event happens for both Due ...
2 votes
1 answer
74 views

Example workflow when changing a site's identify provider

I'm switching a site from ADFS/AD to Azure B2C/AAD and require users to reset their password. Users will also see different log in screens. I'm struggling to find an approach where users won't be ...
0 votes
1 answer
162 views

Smartphone-only apps: consequences of limiting one account per phone number?

For smartphone-only apps that require each user to be a person (apps where there is no room for people to have multiple accounts), what are the negative consequences of limiting each phone number to ...
78 votes
10 answers
27k views

Should users be allowed to use any special character they want when creating a password?

I came across a number of login configuration settings where there is a list of allowable special characters and was wondering: Does this limitation cater for a specific security or usability need? ...
2 votes
2 answers
338 views

Layman's term and description for 2-Step Verification process

Many of us are probably used to seeing or hearing the term 'Two factor authentication' or '2 Step Verification' process by now, although we are probably more familiar with the interaction involved (i....
5 votes
4 answers
1k views

How to prevent creation of multiple accounts under the same company?

Let's say there's Company ABC and Employee A signed-up for an account under his own email address (e.g. [email protected]). However, let's say Employee B signed-up under the same company but ...
0 votes
1 answer
277 views

Separators in user config screen (Polymer/material) [closed]

I managed to create a usable screen to manage credentials. It's a bit tricky, because users can set login/password pair, as well as Facebook. However, a user could have just facebook, just login/pass, ...
5 votes
2 answers
220 views

Mobile application without direct authorization \ registration

UX \ UI professionals. The question connects both the user experience and data security. We are going to build the app, where the user is going to pay for the services. He should enter his email, ...
26 votes
11 answers
11k views

How to ensure users can't sign up for multiple accounts?

I'm working on a web app right now which users will normally have to pay to use, but I want to also offer a short demo period (haven't settled on how long yet, but somewhere between 1 day and 1 week). ...
1 vote
4 answers
3k views

How to clearly distinguish a login page from a register page?

I recently conducted a series of user experience evaluation sessions for a prototype application that had been developed with the goal of capturing user experience bottlenecks and other issues. Each ...
4 votes
3 answers
4k views

Facebook/Twitter login only vs. Facebook/Twitter signup and login separately

I have searched for this topic here, but haven't found solid answers for the problem. So the situation is this: we are creating the authentication screens for a mobile app and we are not sure which ...