Questions tagged [authentication]
use this tag for questions related to authentication in the context of security
15
questions
70
votes
8
answers
81k
views
How to tell a user their login credentials are incorrect?
When a user has entered incorrect details into a login form, is it better to tell them:
The username or password you have entered is invalid.
or
The username you have entered is invalid (for ...
- 5,888
78
votes
11
answers
26k
views
Should users be allowed to use any special character they want when creating a password?
I came across a number of login configuration settings where there is a list of allowable special characters and was wondering:
Does this limitation cater for a specific security or usability need?
...
- 6,996
30
votes
6
answers
3k
views
Forcing users to use a particular pattern for passwords
Many websites, specially government ones, enforce users to use a password which conforms to particular criteria. For example: use between 8-13 characters with at-least one integer and one capital ...
- 4,961
6
votes
4
answers
899
views
Business application: Is it better to redirect or pop-up for re-authentication?
This question is geared for a line of business application someone would pay for, not a general public facing website.
Is it better to redirect for authentication/re-authentication or show a pop-up?
...
- 4,725
6
votes
10
answers
6k
views
Is there any advantage of signup before login with social plugins?
I am building a site and was thinking about if there should be a signup option at all.
I found the question about the difference between sign up and log in with Facebook/Google/etc but there was ...
- 113
4
votes
3
answers
550
views
Is offering more than one openid/social-sign-in option a good idea?
Lots of sites nowadays offer the option to log in via Google, Facebook, LinkedIn and so on, and sometimes a standard username/password option as well.
While this goes a long way toward helping users ...
- 1,886
21
votes
5
answers
34k
views
Is a "Login Successful" Message Necessary?
On an informational/forum website (say, similar to a StackExchange site), is it necessary to show a "login successful" message?
Clarification: On the site in question, the users can log in by ...
- 1,479
20
votes
5
answers
3k
views
Whats more user friendly local authentication or remote authentication (OpenID, OAuth)
From a usability perspective only (not security), what do users find more comfortable?
A site with its own login page (need to sign up but then easier to login;
or a site with remote authentication (...
- 3,542
14
votes
3
answers
2k
views
Is it bad practice not to allow users to create an account (versus OAuth or OpenID)?
When creating a website is it poor practice not to give users the option to "create an account"? Especially with rapid development, it seems more secure with less effort to offload authentication. ...
- 529
12
votes
2
answers
780
views
Dealing with Connected Social Accounts and Potential Orphans
Our application has the following signup paths:
Twitter Connect
Facebook Connect
Email/Password
Once you signup with one, you have the option to connect either both social account (in the case of an ...
- 121
9
votes
4
answers
7k
views
How many incorrect attempts should be allowed before invalidating a password?
I am trying to prevent brute force attacks on a user's account by invalidating a password when too many attempts are made in the same minute, hour, day or something similar. The credentials in this ...
9
votes
5
answers
1k
views
Why would you, for a local authentication site, have usernames, instead of using e-mail address to login?
In websites where authentication is local, or mixed local and remote (e.g. OpenID), I still often see the question for a username. I can very well understand this in the case of twitter, where the ...
user745
5
votes
4
answers
1k
views
How to prevent creation of multiple accounts under the same company?
Let's say there's Company ABC and Employee A signed-up for an account under his own email address (e.g. [email protected]). However, let's say Employee B signed-up under the same company but ...
- 4,238
4
votes
2
answers
229
views
How to request a third-party login within a seperate mobile application
I'm designing a mobile app that requires the user to log-in with their LinkedIn account.
I feel I might have cluttered too much info into it, but everything seems to be important.
I want the user to ...
- 4,487
0
votes
1
answer
276
views
Separators in user config screen (Polymer/material) [closed]
I managed to create a usable screen to manage credentials. It's a bit tricky, because users can set login/password pair, as well as Facebook. However, a user could have just facebook, just login/pass, ...
- 277