Questions tagged [authentication]
use this tag for questions related to authentication in the context of security
131
questions
1
vote
2
answers
47
views
What should the default 2FA method be for a user opening an account?
Our application (investment solution) asks users to set up a 2FA method after setting their password during onboarding.
We offer multiple methods of 2FA; memorable questions, text message security, ...
- 13
1
vote
2
answers
152
views
Is a process secure if it's not perceived as such?
We just finished research for an article on 2FA (Two-Factor Authentication) and, while writing the report on the insights, I got wondering on this particular finding: Our research indicates that most ...
- 37.3k
2
votes
1
answer
69
views
Should authenticated users still see the app's public home page
Let's take two examples:
GitHub → the public page at github.com is a presentation of GitHub's features. Once a user is logged in, he never sees this home page again: github.com become the user's ...
- 123
2
votes
1
answer
288
views
iOS apps log users out when upgrading to a new phone
Why do so many apps log users out after upgrading to a new phone ? (ex: Gmail, Slack, Instagram).
From a technical POV it's easy to keep the user logged in after a phone upgrade.
Is there any upside ...
- 123
2
votes
3
answers
101
views
Does onboarding include sign up?
I'm designing a matchmaking platform for influencers and marketers. I want to create a secure platform that verifies identities (both influencers, and marketers that work for legit brands).
I am ...
- 21
0
votes
1
answer
40
views
Whats the best approach to restoring access to a user who can't access their email?
I'm trying to think of different methods to restore an account to a user who can no longer access their email. For my project, regaining account access is very important, throwing away an account is ...
- 177
0
votes
2
answers
255
views
2FA into the login page (without email or phone number)
I have a question regarding UX of the 2nd factor authentication (2FA) process.
It is common in the authentication process to ask for user id (commonly email) + password, and in a second step ask for ...
- 103
0
votes
3
answers
2k
views
Good UX for validating both phone and email
A website requires users to validate their email – it's how the user receives their password creation link, and email is essential to several core workflows.
There is now also a need to collect and ...
- 12.1k
1
vote
1
answer
97
views
How would you visualize authorization deviation with 90+ rules?
Users can preselect an authorization set (1). And, later on, modify the set. As a user, I want to see how the original authorization set differs from the one I changed. So I can see which ...
- 75
3
votes
1
answer
81
views
Evolution of authentication-based navigation
Consider the case where an unauthenticated user sees a main navigation with a few items:
In the old days, someone with admin privileges might log in and simply see additional items exclusive to their ...
- 12.1k
1
vote
1
answer
69
views
Quantifying the impact of offering alternative signup/login methods?
Nowadays it's common for websites to offer signup/signin methods that don't require making an account (email/password) for that specific site, for example 'Login with x':
Facebook
Google
Twitter
...
- 289
2
votes
1
answer
274
views
Should users be given a way to link a password after social auth?
Obviously it is very common for sites to allow log in using both the traditional email/password as well as social authentication using Facebook, Google, Twitter etc.
If a user creates an account using ...
- 121
0
votes
2
answers
57
views
How many times should an unverified user be allowed to post on a social site?
If you allowed user to post content on social media site prior to verifying email, in order to increase conversions, how many times should he be allowed to do so?
What anti-spam measures you can put ...
- 1
1
vote
1
answer
253
views
User signs up using their Facebook account logs and then logs in with their (same email) Google account. Now what?
Our web app (a personal calendar-management tool) offers both Facebook and Google as social login providers. Sometimes a user who originally signed up using a Facebook account tries to log in using ...
- 1,833
5
votes
5
answers
223
views
Validation without an explicit confirmation
I am currently working on an app. This app has some features that the user can unlock by entering a numeric code.
I was considering putting an automatic validation as soon as the user types the last ...
- 95
0
votes
1
answer
247
views
Best way to suggest enabling cross-site cookies with Brave
For technical reasons (OIDC library uses CORS requests to renew API access tokens), our application requires that when using the Brave browser, the security shields built into Brave be either disabled ...
- 103
2
votes
1
answer
127
views
How to design interactions for guiding users to install an application during sign up process
Application objective
We have a mobile application where a sales employee will be able to login to see his sales stats for the month. The data available to the employee is restricted to only his own ...
1
vote
2
answers
250
views
What would be the success criteria for user testing for 2FA authentication
i'm conducting a user testing session for a few prototypes. one of the prototypes of a feature i'll be testing is the 2 factor authentication.
Compared to other features which have more of an ...
- 10.6k
0
votes
4
answers
272
views
At what step in the user flow of a travel booking app would 2FA OTP be needed
i'm designing a 2FA OPT feature for an app that lets users book flights and trains. As users are able to store personal information including their payment details, this level of verification is ...
- 10.6k
0
votes
1
answer
39
views
Which is the best way to present to the user a 2-categories-login-field?
I have a login screen that has two ways of authentication: via e-mail or a numeric code.
So i'm wondering if i should make the user decide(use a tab-bar or a switch...) which kind of login auth he ...
4
votes
2
answers
484
views
How to get around wanting to use email as unique login, but having existing users with multiple accounts per email?
I viewed
Should multiple user accounts be allowed to use the same email address?
My problem is that we're writing the new version of our website, but need to migrate the old user database to the new ...
1
vote
1
answer
125
views
Button appears in two important locations and feels redundant
I'm building a log in page but ran into an issue with my nav bar. As you can see the "Log In" button appears in two locations.
What's the best way to approach this? To me it looks odd to have it ...
- 13
4
votes
2
answers
207
views
What are the advantages of selfies for security?
A former client of us hired us again after 3 years. In that period, they had many changes, one of them the use of selfies for security reasons.
I have found this type of security from time to time, ...
- 37.3k
1
vote
4
answers
2k
views
How to Block Multiple Logins /Sign Up?
So, I have an App where the user needs to sign up to access the app.
I'm planning to run an offer where user can order that item only once in a day.
But I have the doubt that he may change login Id (...
- 41
0
votes
1
answer
134
views
Automatical Button-Less Login
I'm working on a project where we want to setup a button-less login form.
The idea is, if you enter your credentials correctly, you will get logged in automatically (don't have to press ENTER or ...
- 101
2
votes
4
answers
95
views
Will users tolerate starting over when their key identification is changed?
The main function of my app:
Two users select each other by phone number
Neither of them is aware of the other at the beginning
Based on certain activities over time, an event happens for both
Due ...
- 123
2
votes
1
answer
70
views
Example workflow when changing a site's identify provider
I'm switching a site from ADFS/AD to Azure B2C/AAD and require users to reset their password. Users will also see different log in screens. I'm struggling to find an approach where users won't be ...
- 125
0
votes
1
answer
151
views
Smartphone-only apps: consequences of limiting one account per phone number?
For smartphone-only apps that require each user to be a person (apps where there is no room for people to have multiple accounts), what are the negative consequences of limiting each phone number to ...
user121402
2
votes
2
answers
2k
views
Get the user to accept Terms & Conditions when signing up with OAuth
The register form I'm working on allows the user to sign up using their Facebook account or to create a new account by typing their email and password. Here a mockup:
Currently, clicking on the ...
- 51
2
votes
2
answers
301
views
Layman's term and description for 2-Step Verification process
Many of us are probably used to seeing or hearing the term 'Two factor authentication' or '2 Step Verification' process by now, although we are probably more familiar with the interaction involved (i....
- 26.7k
1
vote
4
answers
3k
views
How to clearly distinguish a login page from a register page?
I recently conducted a series of user experience evaluation sessions for a prototype application that had been developed with the goal of capturing user experience bottlenecks and other issues.
Each ...
- 113
4
votes
1
answer
2k
views
What is the proper way to change user email?
I could just put "Email:" field into "Edit profile" form (that is the form to edit current user information) of my site.
But this way it is possible that a user both changes the email in a wrong way ...
- 171
0
votes
1
answer
235
views
Webpage behavior for an expired authentication referral link
I'm working on a Single Sign On service.
An example use case I'm trying to solve is as follows:
User A sends User B a link to www.exampleapp.com/resource/abc. This resource requires authentication ...
- 441
1
vote
1
answer
6k
views
Good UX practices for 2 factor authentication 2FA
I am designing a mobile app that must use two factor authentication. Do you know good practices or research in that field?
One of my concerns is that non tech savvy users may get lost or confused if ...
2
votes
2
answers
406
views
Is there a name for the UX pattern where you enter a code from an unauthenticated device on an authenticated one in order to login?
Several services such as YouTube, Plex, and XFINITY use a pattern in which an unauthenticated device displays a code for the user to enter on an authenticated device. When the user enters the code on ...
- 123
5
votes
8
answers
7k
views
Verifying an account with SMS as opposed to email address
In order to be more secure we're looking into account verification. The two options are:
Email address verification (Asking the user to click a link in an email sent to their account to verify the ...
- 593
1
vote
1
answer
116
views
Authenticating / Validating a user, from an email/SMS invite
I'm designing a system whereby a company creates accounts for it's customers and sends an invite via email/SMS.
The system contains PII, so we need to be cautious with data security.
We need a ...
- 11
1
vote
4
answers
10k
views
What is the terminology for the page to which the user is redirected to, after successful login?
I did quite a search for this both online and offline, but couldn't find a satisfiable answer. Some of my colleagues suggested terminologies like Dashboard, Home page, Welcome page, landing page, etc. ...
- 111
4
votes
2
answers
646
views
Is Gmail verification really user friendly?
I want to access my gmail, but when I try to login in via the web it shows an alert "verify its you". In case if I lost my mobile or the phone is dead or network is down, I'm unable to verify the code ...
- 2,934
5
votes
4
answers
1k
views
How to prevent creation of multiple accounts under the same company?
Let's say there's Company ABC and Employee A signed-up for an account under his own email address (e.g. [email protected]). However, let's say Employee B signed-up under the same company but ...
- 4,238
1
vote
2
answers
133
views
Presentation of public and private instances
In my application there exist publicly available and browsable objects. However, users are also able to register, authenticate and then author and manage their own personal instances of these same ...
- 11
2
votes
1
answer
600
views
What is the best way to integrate OAuth into an existing authentication system?
I'm currently working on a project to integrate OAuth with a pre-existing, in-house auth system. We have uncovered a number of potential issues, and I'm surprised to find so little online about what I ...
- 131
3
votes
3
answers
906
views
Two factor authentication in a single form
We are working on implementing a Google two factor authentication in our app. Each customer can turn 2FA on and off for their users in app settings.
There was an idea to tweak this functionality. We ...
- 506
1
vote
3
answers
374
views
Giving user a preference to pick either TouchID or Pin login on iOS platform
As of iPhone5s we have technology like TouchID which is much secure way of authenticating user instead writing long complicated passwords. Although, we also have a pin login which does require minimal ...
- 13
2
votes
2
answers
3k
views
What are the pro's and con's of an extended user session?
When having a portal where due to regulations, the content displayed inside must be accessed through user authentication (username / password). Are there best practices / pros and cons of having ...
3
votes
5
answers
935
views
What happens when users are given a secret URL instead of a username/password?
I'm on the fence in regards to whether I should implement user accounts or secret URLs. There are pros and cons to both, and I'm currently leaning in favor of the secret URLs because of the simplicity:...
- 339
2
votes
1
answer
169
views
different pricing for new customers VS. existing customers
how would you go about showing different prices to different users?
currently working on a mobile network's website, and its been requested to show different pricing depending on if the user is new ...
- 95
2
votes
1
answer
243
views
When using embedded browser authentication, how can I increase user trust?
I have run into this situation before but I will speak specifically about a current project, since it is a good example.
I am building a desktop application that uses the Stack Exchange API, and ...
- 2,612
1
vote
2
answers
110
views
App authentication providers
I'm in the early stages of developing a new Android app which will require authentication (data driven app using Firebase database with user specific data). I've considered authentication options and ...
- 111
1
vote
3
answers
71
views
Best format and maximum length for manually typed authentication code
I need to send one-time codes with a relatively short expiration time (say 15 minutes). Potentially there may be hundreds of codes active at the same time.
What are suggested formats for this?
Any ...
- 133