Questions tagged [authentication]
use this tag for questions related to authentication in the context of security
131
questions
1
vote
1
answer
59
views
For a closed off API, is not more friendly to have only a 'secret' - no 'username'?
Quite a few API's have something like a 'username' and a 'secret'.
Is there anything against the decission to just work with a (generated) secret?
Of course the secret should be long enough - GUID ...
- 935
0
votes
1
answer
51
views
Allow users to mark asset as "found" without account?
I have a website where a user can post something they are looking for and the ad gets distributed out to a public board (technically multiple) anyone can see. Up to this point (99% of the site) my ...
- 15.3k
1
vote
1
answer
217
views
Common email pitfalls for social login integrations
We are planning to implement social logins on our site. (Potentially via a service like Janrain or Auth0.) For us the user's email is key, so we will implement only services that expose the user's ...
- 113
0
votes
1
answer
276
views
Separators in user config screen (Polymer/material) [closed]
I managed to create a usable screen to manage credentials. It's a bit tricky, because users can set login/password pair, as well as Facebook. However, a user could have just facebook, just login/pass, ...
- 277
5
votes
1
answer
2k
views
What percent of Android users with fingerprint enabled phones use the fingerprint feature?
We recently added Android fingerprint authentication to our app. Currently, only 51% of users who have seen the fingerprint prompt have enabled the feature. I'm not sure if the number is low due to ...
1
vote
1
answer
47
views
Is using screen unlock pattern feature a good option for login on mobile web
trying to come up with way(s) to reduce the users' drop off rate on mobile login/registration on a mobile web ecommerce site.
1 method i think could work and would like to probably test would be a ...
- 10.6k
2
votes
4
answers
747
views
User migration when some users signed up to the old system and some to the new one
Our team has a challenging UX issue we are trying to solve neatly. We have rebuilt an existing system from scratch and there is a technical constraint that old users will need to re-register to the ...
- 121
2
votes
5
answers
283
views
is replying to an sms a reliable way of authenticating a response
I have a web app which will relay messages from my desktop applications (which is a workflow application for my client).
A typical message would be - 'you have booked your pc in for a service and we ...
- 121
6
votes
7
answers
1k
views
What is the best mobile number authorization strategy?
In recent years, mobile number has become an important factor for authentication and hence more and more enterprises employ methods to capture their users' mobile numbers using SMS.
In a typical ...
- 105
2
votes
1
answer
78
views
Should web sites have their own authentication?
If I am designing a web site that interacts with the same user over time via email or other messaging mediums, should I allow account creation on the web site using a traditional username/password/...
- 123
4
votes
1
answer
145
views
How to explain the concept of choosing password to user
We have an online store application that uses one-time passwords for user login. The user enters her email address, and we email her a one-time password to log in with.
She doesn't choose any ...
- 193
1
vote
2
answers
668
views
Linking multiple third-party accounts for a mobile app?
My user wants to access personal content from her Spotify, Soundcloud and other third-party accounts through one native mobile application. Imagine a music player for any personal library.
The ...
- 11
5
votes
2
answers
219
views
Mobile application without direct authorization \ registration
UX \ UI professionals. The question connects both the user experience and data security.
We are going to build the app, where the user is going to pay for the services.
He should enter his email, ...
- 151
3
votes
4
answers
1k
views
Correct UX for the scenario when a user forgets the answers to their security questions?
We have an application where a user is required upon registration to set up three security questions and answers
When they login to the application, they must answer one of the questions after ...
- 183
21
votes
5
answers
34k
views
Is a "Login Successful" Message Necessary?
On an informational/forum website (say, similar to a StackExchange site), is it necessary to show a "login successful" message?
Clarification: On the site in question, the users can log in by ...
- 1,479
3
votes
2
answers
226
views
Authentication frequency for polling system
I am building a system to be used for polling during an election. Security is a massive issue as I'm sure you understand!
We are using two factor authentication so the user will be asked to supply a ...
- 8,250
2
votes
1
answer
209
views
If a user has created an account on my iOS app using Google, how should I handle their effort to also create an email account?
Imagine a user logged into my iOS app using their Google account. Months later, they are trying to create an account using their email address (the same one connected to their previous Google social ...
- 21
1
vote
3
answers
121
views
When entering data, should the user be authenticated on clicking "Create" or "Save"?
Having the two options:
Check if user authenticated upon "Save" button click (when the input dialog is shown and filled in with the data)
Check if user authenticated upon "Create" button click (...
- 111
0
votes
2
answers
156
views
Back to login page authentication expiration behaviour
If a user presses back after logging in to a website should the authentication cookie be set to expire because the user expects to be logged out if they can see the login page or not?
- 105
1
vote
5
answers
433
views
How can I make a login form seem more trustworthy?
We have a web app where the user has to log in at the beginning. The login shows our company logo, the name of the product incl. logo of the product and the login form:
I showed this app to a test ...
- 595
2
votes
3
answers
108
views
Visual indication of special privileges
I'm working on a mobile app for android and iOS that lets you manage sports teams. You can follow any team, but can only manage those your account is associated with (You're the coach, for example)
...
user57078
1
vote
2
answers
317
views
Which social login should I use, Google OAuth2 or Google+?
Google supports 4 ways to "sign in with google"
OAuth
OAuth2
Google+
Google Apps
I want a generic "sign in with google", I'm not doing anything app-specific, so the last one is out.
Presumably ...
- 164
9
votes
4
answers
7k
views
How many incorrect attempts should be allowed before invalidating a password?
I am trying to prevent brute force attacks on a user's account by invalidating a password when too many attempts are made in the same minute, hour, day or something similar. The credentials in this ...
4
votes
2
answers
2k
views
Should I verify e-mail format in login form?
My B2B web app's login form has an email and password field.
So far, I'm only checking if the fields are empty. I then make my authentication request, if there's a problem I return only one kind of ...
- 509
1
vote
1
answer
285
views
How to encourage users to download an app to complete strong authentication (two factor)
I'm designing a strong authentication (two factor) solution for a website. Users will be forced to use two factor (legal requirement).
We have two supported methods an SMS verification code texted to ...
- 203
2
votes
1
answer
121
views
In Single Sign On what does SAML "enabled" control do or mean?
I am currently working on the redesign of SSO signup process/form and want to understand what enabling SAML control implies.
The rationale being that if an organisation does not have SSO enabled the ...
- 6,996
78
votes
11
answers
26k
views
Should users be allowed to use any special character they want when creating a password?
I came across a number of login configuration settings where there is a list of allowable special characters and was wondering:
Does this limitation cater for a specific security or usability need?
...
- 6,996
2
votes
1
answer
213
views
A better alternative to asking secret questions and answers when logging in to a banking site
It seems to be a common practice of credit card and banking web sites to ask answers to secret questions each time you log in from a new computer (for obvious reasons)
There are many frustrating ...
- 15.9k
26
votes
11
answers
11k
views
How to ensure users can't sign up for multiple accounts?
I'm working on a web app right now which users will normally have to pay to use, but I want to also offer a short demo period (haven't settled on how long yet, but somewhere between 1 day and 1 week).
...
- 607
0
votes
2
answers
66
views
Putting authentication in preferences
If authentication is completely optional, and provides next to no features, is it okay to dump it in a preferences tab?
7
votes
6
answers
2k
views
Can users login and register via the same form?
In designing my project I've toyed with having the login and registration in the same form. The inputs for the details needed to login would be there initially, and if the user presses the register ...
- 180
7
votes
2
answers
949
views
What is the correct tab-indexing for a log-in form with a "forgot password" link?
I have a login form shown below, and I am trying to figure out the correct tabbing for it for the best accessibility and user-experience. This seems like a very common design, but I haven't found a ...
user31914
4
votes
3
answers
4k
views
Facebook/Twitter login only vs. Facebook/Twitter signup and login separately
I have searched for this topic here, but haven't found solid answers for the problem.
So the situation is this: we are creating the authentication screens for a mobile app and we are not sure which ...
- 188
2
votes
2
answers
1k
views
Which Remember-Me option is the best?
Basically, there seem to be three different behaviours of "Remember Me" authentication:
Definite:
After a successful login, a user doesn't have to provide their credentials during a time span with a ...
- 3,897
3
votes
1
answer
307
views
How to manage credentials information to the user?
I've created a plugin for an editor.
This plugin gets some information from the project and shows you all the related issues, getting the information from an external application (Github, gitlab, ...
- 31
3
votes
2
answers
2k
views
Best practice for two-factor authentication process
Perhaps due to the recent incidents behind hacking of user database and identity theft, many organizations have introduced the two-factor authentication process, in particular when users are accessing ...
- 26.7k
6
votes
10
answers
6k
views
Is there any advantage of signup before login with social plugins?
I am building a site and was thinking about if there should be a signup option at all.
I found the question about the difference between sign up and log in with Facebook/Google/etc but there was ...
- 113
1
vote
3
answers
191
views
E-mail requirement in game signup process?
I have to make a signup form for a mobile web based game. I want to make is simple.
I'm going to request an username and password from the player.
May I request an e-mail, and send an activation mail ...
user51865
0
votes
1
answer
323
views
Why do you need a login/ register button?
I'm wondering if it makes sense to have "login/register" buttons displayed on the website header.
The client would be redirected anyway to the register/login page whenever it tries to access a ...
- 131
0
votes
3
answers
4k
views
Better Registration for Mobile Apps
We want to let users register on our Mobile App with their Phone Number, then verify it using SMS without the need to enter a password -- may be like what WhatsApp is doing with their on-boarding ...
- 643
12
votes
2
answers
780
views
Dealing with Connected Social Accounts and Potential Orphans
Our application has the following signup paths:
Twitter Connect
Facebook Connect
Email/Password
Once you signup with one, you have the option to connect either both social account (in the case of an ...
- 121
0
votes
3
answers
581
views
Sign Up and Sign In widget on every page: Slide-down Panel or Lightbox
I have a question about implementing a sign up and sign in widget that works on any page on a site (i.e. without redirecting users to a sign in page when they want to log in to interact with content ...
- 89
4
votes
1
answer
642
views
What is the proper way to provide social media authentication: in login or register form?
We provided standard login/registration forms for providing email and password, but I'd also like to allow user use my website after oAuth authentication.
Should they be able to register or login via ...
- 143
2
votes
5
answers
2k
views
Do people expect to mistype their passwords?
I expect people have to type in passwords pretty regularly. Sometimes if you haven't typed it in for a while but end up faced with a login prompt, you think you remember the password, type it in, and ...
- 3,580
4
votes
2
answers
710
views
What is the best way to notify a user he doesn't have an account
As a helpdesk engineer I'm offering support on a rather big Belgian E-commerce website.
While we have a vast number of users there are also many users whose account is deleted automatically after 1 ...
- 346
17
votes
3
answers
9k
views
social sign in redirect vs popup window
I have seen that most websites usually open the "login with Facebook" page in a popup window, but there are also some websites (like stackexchange) that just redirect the browser without opening a ...
- 337
4
votes
2
answers
218
views
How to ask for a user's identity?
My company is working on an internal phone application to be used by many users that requires authentication. Based on historical data, we can assume the likelihood of a user's identity at a given ...
- 360
1
vote
2
answers
263
views
UX Design where password is optional
I have a web site where some users authenticate with email/password and other users only require an email address to authenticate.
I'm trying to make the most natural login screen, but I'm struggling ...
- 185
1
vote
3
answers
319
views
Is email field assistance still necessary?
For registration forms, it seems the trend now is to allow any password a user wants, as long as you inform him if it's weak.
With this in mind, should we still validate email fields on the client ...
- 683
3
votes
2
answers
103
views
Status feedback problem
We have a mobile application. To register in our application you need to enter your phone number. After that, you receive an SMS with a code you need to enter to confirm your phone number.
There is a ...
- 741