Questions tagged [authentication]

use this tag for questions related to authentication in the context of security

Filter by
Sorted by
Tagged with
78 votes
11 answers
26k views

Should users be allowed to use any special character they want when creating a password?

I came across a number of login configuration settings where there is a list of allowable special characters and was wondering: Does this limitation cater for a specific security or usability need? ...
Okavango's user avatar
  • 6,996
70 votes
8 answers
81k views

How to tell a user their login credentials are incorrect?

When a user has entered incorrect details into a login form, is it better to tell them: The username or password you have entered is invalid. or The username you have entered is invalid (for ...
F21's user avatar
  • 5,888
30 votes
6 answers
3k views

Forcing users to use a particular pattern for passwords

Many websites, specially government ones, enforce users to use a password which conforms to particular criteria. For example: use between 8-13 characters with at-least one integer and one capital ...
Salman Ehsan's user avatar
  • 4,961
26 votes
11 answers
11k views

How to ensure users can't sign up for multiple accounts?

I'm working on a web app right now which users will normally have to pay to use, but I want to also offer a short demo period (haven't settled on how long yet, but somewhere between 1 day and 1 week). ...
ArtOfWarfare's user avatar
22 votes
2 answers
2k views

What's better for invitation emails: a temporary password or a one-time login url?

Our web app allows our customers to invite their collaborators into their account. They can submit the new user's email address, and our app sends the new user an email inviting them to login. Once ...
Sam Pierce Lolla's user avatar
21 votes
5 answers
34k views

Is a "Login Successful" Message Necessary?

On an informational/forum website (say, similar to a StackExchange site), is it necessary to show a "login successful" message? Clarification: On the site in question, the users can log in by ...
GWR's user avatar
  • 1,479
20 votes
5 answers
3k views

Whats more user friendly local authentication or remote authentication (OpenID, OAuth)

From a usability perspective only (not security), what do users find more comfortable? A site with its own login page (need to sign up but then easier to login; or a site with remote authentication (...
Sruly's user avatar
  • 3,542
17 votes
5 answers
3k views

Should I use two steps or one when users change password?

I currently have a page dedicated to changing passwords. There are 2 options: A 2 step option: download bmml source – Wireframes created with Balsamiq Mockups download bmml source A 1 step ...
F21's user avatar
  • 5,888
17 votes
3 answers
9k views

social sign in redirect vs popup window

I have seen that most websites usually open the "login with Facebook" page in a popup window, but there are also some websites (like stackexchange) that just redirect the browser without opening a ...
Marc M.'s user avatar
  • 337
15 votes
7 answers
11k views

Should my app send a confirmation email on user registration?

I'm grappling with the user registration experience for my application. I'm considering this model: User enters... Username Password Password confirmation Email address The app displays a message ...
Ethan's user avatar
  • 251
14 votes
6 answers
1k views

What is the best way to request individual characters from a password?

Frequently, sites that should really value security (especially banks) ask for several individual characters from a password. Typically I've seen them do it like this: download bmml source – ...
alexmuller's user avatar
14 votes
3 answers
2k views

Is it bad practice not to allow users to create an account (versus OAuth or OpenID)?

When creating a website is it poor practice not to give users the option to "create an account"? Especially with rapid development, it seems more secure with less effort to offload authentication. ...
ramblinjan's user avatar
12 votes
2 answers
780 views

Dealing with Connected Social Accounts and Potential Orphans

Our application has the following signup paths: Twitter Connect Facebook Connect Email/Password Once you signup with one, you have the option to connect either both social account (in the case of an ...
roomnoise's user avatar
  • 121
9 votes
4 answers
18k views

How do I best tell a user that his/her account will be locked if they enter the wrong credentials too many times?

We are going to add an additional layer of security to our product by locking user accounts for a short period of time (configurable in the product, but probably 5-10 minutes) when a user has tried to ...
Henrik Söderlund's user avatar
9 votes
5 answers
1k views

Why would you, for a local authentication site, have usernames, instead of using e-mail address to login?

In websites where authentication is local, or mixed local and remote (e.g. OpenID), I still often see the question for a username. I can very well understand this in the case of twitter, where the ...
user avatar
9 votes
4 answers
7k views

How many incorrect attempts should be allowed before invalidating a password?

I am trying to prevent brute force attacks on a user's account by invalidating a password when too many attempts are made in the same minute, hour, day or something similar. The credentials in this ...
Alexandre Martins's user avatar
8 votes
2 answers
509 views

Masked password characters in a GUI vs terminal

In a GUI form, or for example a login box on a website, it's usual for masked characters to appear like ********* as you type out your password. But in terminal applications, for example ssh, this ...
wim's user avatar
  • 327
7 votes
4 answers
5k views

Password validation in login form

In registration form, I have client side validation for strength of password. For example password should be not less than 6 symbols, consists at least 1 digit, and at least 1 letter. For example: ...
Evghenii Maslennikov's user avatar
7 votes
2 answers
949 views

What is the correct tab-indexing for a log-in form with a "forgot password" link?

I have a login form shown below, and I am trying to figure out the correct tabbing for it for the best accessibility and user-experience. This seems like a very common design, but I haven't found a ...
user avatar
7 votes
6 answers
2k views

Can users login and register via the same form?

In designing my project I've toyed with having the login and registration in the same form. The inputs for the details needed to login would be there initially, and if the user presses the register ...
James Monger's user avatar
6 votes
10 answers
6k views

Is there any advantage of signup before login with social plugins?

I am building a site and was thinking about if there should be a signup option at all. I found the question about the difference between sign up and log in with Facebook/Google/etc but there was ...
nxshar2's user avatar
  • 113
6 votes
4 answers
899 views

Business application: Is it better to redirect or pop-up for re-authentication?

This question is geared for a line of business application someone would pay for, not a general public facing website. Is it better to redirect for authentication/re-authentication or show a pop-up? ...
rick schott's user avatar
  • 4,725
6 votes
7 answers
1k views

What is the best mobile number authorization strategy?

In recent years, mobile number has become an important factor for authentication and hence more and more enterprises employ methods to capture their users' mobile numbers using SMS. In a typical ...
anonim's user avatar
  • 105
6 votes
2 answers
552 views

How can I encourage users to authenticate?

I am working on a post-sale customer support project for a US high street retailer (for the rest of this post I will refer to them as 'Jon's Cellphones'). The program will enable customers who ...
Jon White's user avatar
  • 1,798
6 votes
1 answer
142 views

What OpenID log-in screen is appropriate for people who don't understand SAML, OpenID, or Federation?

Every person that I've introduced to Stackexchange has had the same question/problem... that is they are confused by options to log using "gmail" or "hotmail" and assume that this is an email ...
makerofthings7's user avatar
5 votes
4 answers
361 views

Logging in with email only

I'm working on a blog and there will be an option to post a comment. I could implement registration with username, password and email — the standard way. I could implement 3rd-party authorization ...
daGrevis's user avatar
  • 151
5 votes
8 answers
7k views

Verifying an account with SMS as opposed to email address

In order to be more secure we're looking into account verification. The two options are: Email address verification (Asking the user to click a link in an email sent to their account to verify the ...
Mitch's user avatar
  • 593
5 votes
1 answer
205 views

How important is social sign-up to attracting new users?

Many website, including this one, are using social sign-up to speed up new user registrations. I'd like to know what are the adoption rates of this service, and whether there are any pitfalls to using ...
ted.strauss's user avatar
5 votes
5 answers
223 views

Validation without an explicit confirmation

I am currently working on an app. This app has some features that the user can unlock by entering a numeric code. I was considering putting an automatic validation as soon as the user types the last ...
Mel's user avatar
  • 95
5 votes
4 answers
1k views

Biometrics Activated UI

I'm having a problem regarding a user interface with bio-metrics inter action in employee logging in/out. The employee needs to choose whether he/she will login or logout and enter his/her employee ...
John Isaiah Carmona's user avatar
5 votes
4 answers
1k views

How to prevent creation of multiple accounts under the same company?

Let's say there's Company ABC and Employee A signed-up for an account under his own email address (e.g. [email protected]). However, let's say Employee B signed-up under the same company but ...
catandmouse's user avatar
  • 4,238
5 votes
1 answer
2k views

What percent of Android users with fingerprint enabled phones use the fingerprint feature?

We recently added Android fingerprint authentication to our app. Currently, only 51% of users who have seen the fingerprint prompt have enabled the feature. I'm not sure if the number is low due to ...
Ben Ruggeberg's user avatar
5 votes
2 answers
219 views

Mobile application without direct authorization \ registration

UX \ UI professionals. The question connects both the user experience and data security. We are going to build the app, where the user is going to pay for the services. He should enter his email, ...
Rikki Tikki Tavi's user avatar
4 votes
6 answers
587 views

Is there a way to disallow multiple votes from one user without forcing authentication? [closed]

I'm looking for a way to prohibit voting rigging (cache/cookie-clearing, etc.) without requiring the user to jump through hoops (registration, authentication, etc.). Any ideas?
GoodShovel's user avatar
4 votes
1 answer
2k views

What is the proper way to change user email?

I could just put "Email:" field into "Edit profile" form (that is the form to edit current user information) of my site. But this way it is possible that a user both changes the email in a wrong way ...
porton's user avatar
  • 171
4 votes
3 answers
4k views

Facebook/Twitter login only vs. Facebook/Twitter signup and login separately

I have searched for this topic here, but haven't found solid answers for the problem. So the situation is this: we are creating the authentication screens for a mobile app and we are not sure which ...
skywlkr's user avatar
  • 188
4 votes
2 answers
218 views

How to ask for a user's identity?

My company is working on an internal phone application to be used by many users that requires authentication. Based on historical data, we can assume the likelihood of a user's identity at a given ...
Bryce's user avatar
  • 360
4 votes
3 answers
550 views

Is offering more than one openid/social-sign-in option a good idea?

Lots of sites nowadays offer the option to log in via Google, Facebook, LinkedIn and so on, and sometimes a standard username/password option as well. While this goes a long way toward helping users ...
Assaf Lavie's user avatar
  • 1,886
4 votes
2 answers
2k views

Should I verify e-mail format in login form?

My B2B web app's login form has an email and password field. So far, I'm only checking if the fields are empty. I then make my authentication request, if there's a problem I return only one kind of ...
ThunderDev's user avatar
4 votes
2 answers
710 views

What is the best way to notify a user he doesn't have an account

As a helpdesk engineer I'm offering support on a rather big Belgian E-commerce website. While we have a vast number of users there are also many users whose account is deleted automatically after 1 ...
ThomasSt's user avatar
  • 346
4 votes
2 answers
229 views

How to request a third-party login within a seperate mobile application

I'm designing a mobile app that requires the user to log-in with their LinkedIn account. I feel I might have cluttered too much info into it, but everything seems to be important. I want the user to ...
Yosef Waysman's user avatar
4 votes
2 answers
484 views

How to get around wanting to use email as unique login, but having existing users with multiple accounts per email?

I viewed Should multiple user accounts be allowed to use the same email address? My problem is that we're writing the new version of our website, but need to migrate the old user database to the new ...
FrankDrebin893's user avatar
4 votes
2 answers
207 views

What are the advantages of selfies for security?

A former client of us hired us again after 3 years. In that period, they had many changes, one of them the use of selfies for security reasons. I have found this type of security from time to time, ...
Devin's user avatar
  • 37.3k
4 votes
1 answer
145 views

How to explain the concept of choosing password to user

We have an online store application that uses one-time passwords for user login. The user enters her email address, and we email her a one-time password to log in with. She doesn't choose any ...
Kayhan Asghari's user avatar
4 votes
2 answers
646 views

Is Gmail verification really user friendly?

I want to access my gmail, but when I try to login in via the web it shows an alert "verify its you". In case if I lost my mobile or the phone is dead or network is down, I'm unable to verify the code ...
Pradeep's user avatar
  • 2,934
4 votes
1 answer
642 views

What is the proper way to provide social media authentication: in login or register form?

We provided standard login/registration forms for providing email and password, but I'd also like to allow user use my website after oAuth authentication. Should they be able to register or login via ...
Kamil Lelonek's user avatar
3 votes
3 answers
789 views

Forcing users to use a new password everytime they reset

This is getting common that while resetting one's password, web-applications force users not to use a password which they had used before. Just like forcing users to follow a particular pattern of ...
Salman Ehsan's user avatar
  • 4,961
3 votes
4 answers
1k views

Correct UX for the scenario when a user forgets the answers to their security questions?

We have an application where a user is required upon registration to set up three security questions and answers When they login to the application, they must answer one of the questions after ...
Mike's user avatar
  • 183
3 votes
2 answers
2k views

Best practice for two-factor authentication process

Perhaps due to the recent incidents behind hacking of user database and identity theft, many organizations have introduced the two-factor authentication process, in particular when users are accessing ...
Michael Lai's user avatar
  • 26.7k
3 votes
2 answers
226 views

Authentication frequency for polling system

I am building a system to be used for polling during an election. Security is a massive issue as I'm sure you understand! We are using two factor authentication so the user will be asked to supply a ...
colmcq's user avatar
  • 8,250