Questions tagged [authentication]
use this tag for questions related to authentication in the context of security
131
questions
3
votes
3
answers
789
views
Forcing users to use a new password everytime they reset
This is getting common that while resetting one's password, web-applications force users not to use a password which they had used before. Just like forcing users to follow a particular pattern of ...
- 4,961
8
votes
2
answers
509
views
Masked password characters in a GUI vs terminal
In a GUI form, or for example a login box on a website, it's usual for masked characters to appear like ********* as you type out your password.
But in terminal applications, for example ssh, this ...
- 327
30
votes
6
answers
3k
views
Forcing users to use a particular pattern for passwords
Many websites, specially government ones, enforce users to use a password which conforms to particular criteria. For example: use between 8-13 characters with at-least one integer and one capital ...
- 4,961
14
votes
6
answers
1k
views
What is the best way to request individual characters from a password?
Frequently, sites that should really value security (especially banks) ask for several individual characters from a password.
Typically I've seen them do it like this:
download bmml source – ...
- 389
22
votes
2
answers
2k
views
What's better for invitation emails: a temporary password or a one-time login url?
Our web app allows our customers to invite their collaborators into their account. They can submit the new user's email address, and our app sends the new user an email inviting them to login. Once ...
- 2,237
5
votes
4
answers
361
views
Logging in with email only
I'm working on a blog and there will be an option to post a comment.
I could implement registration with username, password and email — the standard way. I could implement 3rd-party authorization ...
- 151
0
votes
1
answer
173
views
How should I go about integrating Mozilla Persona in a website?
For those who've never heard of it before, Mozilla Persona is a single sign-on method that's pretty strict on privacy. For me, as a website administrator, it means that I don't need to ask the user ...
- 101
3
votes
1
answer
112
views
Mass user authentication for a bracket system
I'm currently setting up a layout for a website that's going to be a sort of "bracket" website, where users can sign up and they can be approved/denied by an administrator. I'm currently at a ...
- 133
15
votes
7
answers
11k
views
Should my app send a confirmation email on user registration?
I'm grappling with the user registration experience for my application.
I'm considering this model:
User enters...
Username
Password
Password confirmation
Email address
The app displays a message ...
- 251
17
votes
5
answers
3k
views
Should I use two steps or one when users change password?
I currently have a page dedicated to changing passwords. There are 2 options:
A 2 step option:
download bmml source – Wireframes created with Balsamiq Mockups
download bmml source
A 1 step ...
- 5,888
9
votes
4
answers
18k
views
How do I best tell a user that his/her account will be locked if they enter the wrong credentials too many times?
We are going to add an additional layer of security to our product by locking user accounts for a short period of time (configurable in the product, but probably 5-10 minutes) when a user has tried to ...
- 191
2
votes
1
answer
225
views
User Authentication/Timeout for web-app with personal Information
The concept behind "Remember my Username" and even allowing browsers to save your "username and password" for this site seems like it could be controversial.
Given that different audiences prefer ...
- 828
4
votes
2
answers
229
views
How to request a third-party login within a seperate mobile application
I'm designing a mobile app that requires the user to log-in with their LinkedIn account.
I feel I might have cluttered too much info into it, but everything seems to be important.
I want the user to ...
- 4,487
7
votes
4
answers
5k
views
Password validation in login form
In registration form, I have client side validation for strength of password. For example password should be not less than 6 symbols, consists at least 1 digit, and at least 1 letter.
For example: ...
5
votes
4
answers
1k
views
Biometrics Activated UI
I'm having a problem regarding a user interface with bio-metrics inter action in employee logging in/out. The employee needs to choose whether he/she will login or logout and enter his/her employee ...
- 1,605
14
votes
3
answers
2k
views
Is it bad practice not to allow users to create an account (versus OAuth or OpenID)?
When creating a website is it poor practice not to give users the option to "create an account"? Especially with rapid development, it seems more secure with less effort to offload authentication. ...
- 529
6
votes
1
answer
142
views
What OpenID log-in screen is appropriate for people who don't understand SAML, OpenID, or Federation?
Every person that I've introduced to Stackexchange has had the same question/problem... that is they are confused by options to log using "gmail" or "hotmail" and assume that this is an email ...
- 1,028
5
votes
1
answer
205
views
How important is social sign-up to attracting new users?
Many website, including this one, are using social sign-up to speed up new user registrations. I'd like to know what are the adoption rates of this service, and whether there are any pitfalls to using ...
- 681
1
vote
2
answers
399
views
Authentication pop up on a desktop app: what if it is much bigger than main app window?
I am working on a desktop app that requires authentication. It allows federated authentication using different services, Google among them. Most probably, we'll use a pop up with a browser window to ...
- 111
3
votes
2
answers
330
views
When is user authentication really necessary?
Better said, how much harder is to mantain a forum/message-board/community webiste with unauthenticated users and what would be the benefits and disadvantages in comparison to an account-based one?
...
- 623
1
vote
1
answer
240
views
When should "Log on" or "Log off" be used? [duplicate]
Possible Duplicate:
Using “Sign in” vs using “Log in”
I'm porting an old application that has a "Log on" screen. When would I use "Log on" vs the alternatives (Sign In / ...
- 1,028
2
votes
1
answer
228
views
Best way to add account providers?
I briefly looked at spotify and I found that they use 2 providers: Themselves and facebook. Ie I can log in to spotify with facebook. But then it asks me for my spotify account when I downloaded the ...
70
votes
8
answers
81k
views
How to tell a user their login credentials are incorrect?
When a user has entered incorrect details into a login form, is it better to tell them:
The username or password you have entered is invalid.
or
The username you have entered is invalid (for ...
- 5,888
4
votes
3
answers
550
views
Is offering more than one openid/social-sign-in option a good idea?
Lots of sites nowadays offer the option to log in via Google, Facebook, LinkedIn and so on, and sometimes a standard username/password option as well.
While this goes a long way toward helping users ...
- 1,886
6
votes
2
answers
552
views
How can I encourage users to authenticate?
I am working on a post-sale customer support project for a US high street retailer (for the rest of this post I will refer to them as 'Jon's Cellphones'). The program will enable customers who ...
- 1,798
3
votes
1
answer
264
views
Looking for 'planner' design patterns and opinions
We are designing a revamped part-time studies course catalogue at the post-secondary institution where I work. One of the features I have included is an authenticated planner for saving and ...
- 1,157
2
votes
6
answers
1k
views
WebApp User Login Screen
I am currently considering options for a web/intranet application login screen and this seems like a good place to share.
Not much work has gone into the current screen since creation and it exists ...
- 23
4
votes
6
answers
587
views
Is there a way to disallow multiple votes from one user without forcing authentication? [closed]
I'm looking for a way to prohibit voting rigging (cache/cookie-clearing, etc.) without requiring the user to jump through hoops (registration, authentication, etc.). Any ideas?
- 909
6
votes
4
answers
900
views
Business application: Is it better to redirect or pop-up for re-authentication?
This question is geared for a line of business application someone would pay for, not a general public facing website.
Is it better to redirect for authentication/re-authentication or show a pop-up?
...
- 4,725
9
votes
5
answers
1k
views
Why would you, for a local authentication site, have usernames, instead of using e-mail address to login?
In websites where authentication is local, or mixed local and remote (e.g. OpenID), I still often see the question for a username. I can very well understand this in the case of twitter, where the ...
user745
20
votes
5
answers
3k
views
Whats more user friendly local authentication or remote authentication (OpenID, OAuth)
From a usability perspective only (not security), what do users find more comfortable?
A site with its own login page (need to sign up but then easier to login;
or a site with remote authentication (...
- 3,542