Questions tagged [authentication]
use this tag for questions related to authentication in the context of security
131
questions
0
votes
1
answer
235
views
Webpage behavior for an expired authentication referral link
I'm working on a Single Sign On service.
An example use case I'm trying to solve is as follows:
User A sends User B a link to www.exampleapp.com/resource/abc. This resource requires authentication ...
CommunityBot
- 1
1
vote
1
answer
6k
views
Good UX practices for 2 factor authentication 2FA
I am designing a mobile app that must use two factor authentication. Do you know good practices or research in that field?
One of my concerns is that non tech savvy users may get lost or confused if ...
- 2,349
2
votes
2
answers
406
views
Is there a name for the UX pattern where you enter a code from an unauthenticated device on an authenticated one in order to login?
Several services such as YouTube, Plex, and XFINITY use a pattern in which an unauthenticated device displays a code for the user to enter on an authenticated device. When the user enters the code on ...
- 37.3k
1
vote
2
answers
133
views
Presentation of public and private instances
In my application there exist publicly available and browsable objects. However, users are also able to register, authenticate and then author and manage their own personal instances of these same ...
CommunityBot
- 1
1
vote
1
answer
116
views
Authenticating / Validating a user, from an email/SMS invite
I'm designing a system whereby a company creates accounts for it's customers and sends an invite via email/SMS.
The system contains PII, so we need to be cautious with data security.
We need a ...
2
votes
5
answers
283
views
is replying to an sms a reliable way of authenticating a response
I have a web app which will relay messages from my desktop applications (which is a workflow application for my client).
A typical message would be - 'you have booked your pc in for a service and we ...
- 687
4
votes
2
answers
646
views
Is Gmail verification really user friendly?
I want to access my gmail, but when I try to login in via the web it shows an alert "verify its you". In case if I lost my mobile or the phone is dead or network is down, I'm unable to verify the code ...
- 37.3k
1
vote
2
answers
110
views
App authentication providers
I'm in the early stages of developing a new Android app which will require authentication (data driven app using Firebase database with user specific data). I've considered authentication options and ...
CommunityBot
- 1
1
vote
3
answers
374
views
Giving user a preference to pick either TouchID or Pin login on iOS platform
As of iPhone5s we have technology like TouchID which is much secure way of authenticating user instead writing long complicated passwords. Although, we also have a pin login which does require minimal ...
- 478
2
votes
1
answer
243
views
When using embedded browser authentication, how can I increase user trust?
I have run into this situation before but I will speak specifically about a current project, since it is a good example.
I am building a desktop application that uses the Stack Exchange API, and ...
- 2,612
2
votes
1
answer
600
views
What is the best way to integrate OAuth into an existing authentication system?
I'm currently working on a project to integrate OAuth with a pre-existing, in-house auth system. We have uncovered a number of potential issues, and I'm surprised to find so little online about what I ...
- 21.3k
2
votes
2
answers
3k
views
What are the pro's and con's of an extended user session?
When having a portal where due to regulations, the content displayed inside must be accessed through user authentication (username / password). Are there best practices / pros and cons of having ...
CommunityBot
- 1
3
votes
5
answers
938
views
What happens when users are given a secret URL instead of a username/password?
I'm on the fence in regards to whether I should implement user accounts or secret URLs. There are pros and cons to both, and I'm currently leaning in favor of the secret URLs because of the simplicity:...
CommunityBot
- 1
2
votes
1
answer
169
views
different pricing for new customers VS. existing customers
how would you go about showing different prices to different users?
currently working on a mobile network's website, and its been requested to show different pricing depending on if the user is new ...
- 95
0
votes
1
answer
51
views
Allow users to mark asset as "found" without account?
I have a website where a user can post something they are looking for and the ad gets distributed out to a public board (technically multiple) anyone can see. Up to this point (99% of the site) my ...
CommunityBot
- 1
1
vote
3
answers
71
views
Best format and maximum length for manually typed authentication code
I need to send one-time codes with a relatively short expiration time (say 15 minutes). Potentially there may be hundreds of codes active at the same time.
What are suggested formats for this?
Any ...
- 21
1
vote
1
answer
59
views
For a closed off API, is not more friendly to have only a 'secret' - no 'username'?
Quite a few API's have something like a 'username' and a 'secret'.
Is there anything against the decission to just work with a (generated) secret?
Of course the secret should be long enough - GUID ...
- 2,788
6
votes
10
answers
6k
views
Is there any advantage of signup before login with social plugins?
I am building a site and was thinking about if there should be a signup option at all.
I found the question about the difference between sign up and log in with Facebook/Google/etc but there was ...
CommunityBot
- 1
1
vote
1
answer
218
views
Common email pitfalls for social login integrations
We are planning to implement social logins on our site. (Potentially via a service like Janrain or Auth0.) For us the user's email is key, so we will implement only services that expose the user's ...
- 830
17
votes
5
answers
3k
views
Should I use two steps or one when users change password?
I currently have a page dedicated to changing passwords. There are 2 options:
A 2 step option:
download bmml source – Wireframes created with Balsamiq Mockups
download bmml source
A 1 step ...
- 3,882
2
votes
4
answers
747
views
User migration when some users signed up to the old system and some to the new one
Our team has a challenging UX issue we are trying to solve neatly. We have rebuilt an existing system from scratch and there is a technical constraint that old users will need to re-register to the ...
CommunityBot
- 1
3
votes
1
answer
307
views
How to manage credentials information to the user?
I've created a plugin for an editor.
This plugin gets some information from the project and shows you all the related issues, getting the information from an external application (Github, gitlab, ...
CommunityBot
- 1
5
votes
1
answer
2k
views
What percent of Android users with fingerprint enabled phones use the fingerprint feature?
We recently added Android fingerprint authentication to our app. Currently, only 51% of users who have seen the fingerprint prompt have enabled the feature. I'm not sure if the number is low due to ...
- 860
1
vote
1
answer
47
views
Is using screen unlock pattern feature a good option for login on mobile web
trying to come up with way(s) to reduce the users' drop off rate on mobile login/registration on a mobile web ecommerce site.
1 method i think could work and would like to probably test would be a ...
- 8,561
6
votes
7
answers
1k
views
What is the best mobile number authorization strategy?
In recent years, mobile number has become an important factor for authentication and hence more and more enterprises employ methods to capture their users' mobile numbers using SMS.
In a typical ...
- 3,826
2
votes
1
answer
78
views
Should web sites have their own authentication?
If I am designing a web site that interacts with the same user over time via email or other messaging mediums, should I allow account creation on the web site using a traditional username/password/...
- 3,702
4
votes
1
answer
145
views
How to explain the concept of choosing password to user
We have an online store application that uses one-time passwords for user login. The user enters her email address, and we email her a one-time password to log in with.
She doesn't choose any ...
- 913
1
vote
2
answers
668
views
Linking multiple third-party accounts for a mobile app?
My user wants to access personal content from her Spotify, Soundcloud and other third-party accounts through one native mobile application. Imagine a music player for any personal library.
The ...
- 199
12
votes
2
answers
780
views
Dealing with Connected Social Accounts and Potential Orphans
Our application has the following signup paths:
Twitter Connect
Facebook Connect
Email/Password
Once you signup with one, you have the option to connect either both social account (in the case of an ...
CommunityBot
- 1
2
votes
1
answer
209
views
If a user has created an account on my iOS app using Google, how should I handle their effort to also create an email account?
Imagine a user logged into my iOS app using their Google account. Months later, they are trying to create an account using their email address (the same one connected to their previous Google social ...
CommunityBot
- 1
3
votes
2
answers
226
views
Authentication frequency for polling system
I am building a system to be used for polling during an election. Security is a massive issue as I'm sure you understand!
We are using two factor authentication so the user will be asked to supply a ...
- 2,088
5
votes
4
answers
361
views
Logging in with email only
I'm working on a blog and there will be an option to post a comment.
I could implement registration with username, password and email — the standard way. I could implement 3rd-party authorization ...
- 425
1
vote
3
answers
121
views
When entering data, should the user be authenticated on clicking "Create" or "Save"?
Having the two options:
Check if user authenticated upon "Save" button click (when the input dialog is shown and filled in with the data)
Check if user authenticated upon "Create" button click (...
- 538
17
votes
3
answers
9k
views
social sign in redirect vs popup window
I have seen that most websites usually open the "login with Facebook" page in a popup window, but there are also some websites (like stackexchange) that just redirect the browser without opening a ...
CommunityBot
- 1
0
votes
3
answers
581
views
Sign Up and Sign In widget on every page: Slide-down Panel or Lightbox
I have a question about implementing a sign up and sign in widget that works on any page on a site (i.e. without redirecting users to a sign in page when they want to log in to interact with content ...
CommunityBot
- 1
0
votes
2
answers
156
views
Back to login page authentication expiration behaviour
If a user presses back after logging in to a website should the authentication cookie be set to expire because the user expects to be logged out if they can see the login page or not?
- 14.2k
1
vote
5
answers
433
views
How can I make a login form seem more trustworthy?
We have a web app where the user has to log in at the beginning. The login shows our company logo, the name of the product incl. logo of the product and the login form:
I showed this app to a test ...
- 1,396
1
vote
3
answers
191
views
E-mail requirement in game signup process?
I have to make a signup form for a mobile web based game. I want to make is simple.
I'm going to request an username and password from the player.
May I request an e-mail, and send an activation mail ...
- 40.9k
0
votes
2
answers
66
views
Putting authentication in preferences
If authentication is completely optional, and provides next to no features, is it okay to dump it in a preferences tab?
CommunityBot
- 1
2
votes
3
answers
108
views
Visual indication of special privileges
I'm working on a mobile app for android and iOS that lets you manage sports teams. You can follow any team, but can only manage those your account is associated with (You're the coach, for example)
...
- 7,818
1
vote
2
answers
317
views
Which social login should I use, Google OAuth2 or Google+?
Google supports 4 ways to "sign in with google"
OAuth
OAuth2
Google+
Google Apps
I want a generic "sign in with google", I'm not doing anything app-specific, so the last one is out.
Presumably ...
- 21
4
votes
2
answers
2k
views
Should I verify e-mail format in login form?
My B2B web app's login form has an email and password field.
So far, I'm only checking if the fields are empty. I then make my authentication request, if there's a problem I return only one kind of ...
- 14.2k
1
vote
1
answer
285
views
How to encourage users to download an app to complete strong authentication (two factor)
I'm designing a strong authentication (two factor) solution for a website. Users will be forced to use two factor (legal requirement).
We have two supported methods an SMS verification code texted to ...
- 139
2
votes
1
answer
121
views
In Single Sign On what does SAML "enabled" control do or mean?
I am currently working on the redesign of SSO signup process/form and want to understand what enabling SAML control implies.
The rationale being that if an organisation does not have SSO enabled the ...
- 68.3k
2
votes
1
answer
213
views
A better alternative to asking secret questions and answers when logging in to a banking site
It seems to be a common practice of credit card and banking web sites to ask answers to secret questions each time you log in from a new computer (for obvious reasons)
There are many frustrating ...
- 551
2
votes
2
answers
1k
views
Which Remember-Me option is the best?
Basically, there seem to be three different behaviours of "Remember Me" authentication:
Definite:
After a successful login, a user doesn't have to provide their credentials during a time span with a ...
- 2,382
0
votes
3
answers
4k
views
Better Registration for Mobile Apps
We want to let users register on our Mobile App with their Phone Number, then verify it using SMS without the need to enter a password -- may be like what WhatsApp is doing with their on-boarding ...
- 381
0
votes
1
answer
323
views
Why do you need a login/ register button?
I'm wondering if it makes sense to have "login/register" buttons displayed on the website header.
The client would be redirected anyway to the register/login page whenever it tries to access a ...
- 12.5k
9
votes
4
answers
18k
views
How do I best tell a user that his/her account will be locked if they enter the wrong credentials too many times?
We are going to add an additional layer of security to our product by locking user accounts for a short period of time (configurable in the product, but probably 5-10 minutes) when a user has tried to ...
CommunityBot
- 1
4
votes
1
answer
642
views
What is the proper way to provide social media authentication: in login or register form?
We provided standard login/registration forms for providing email and password, but I'd also like to allow user use my website after oAuth authentication.
Should they be able to register or login via ...
- 12.2k