Questions tagged [password]
A secret word or string of characters that is used for authentication, to prove identity or gain access to a resource.
0
votes
3answers
77 views
How to encourage the user to check details before submission
I'm upgrading a legacy financial application which requires users to re-enter their password before a transaction is submitted. I need to remove the password check since I'm migrating users to a new ...
2
votes
1answer
116 views
Should this registration form include field for password now or after user passes review?
The scenario I have may be a type of edge case because of the nature of the site I'm working on. This site (note: the site is not e-commerce, it is not about generating revenue; essentially, non-...
1
vote
1answer
99 views
How is a two-step login better than single-step when you have a password manager?
I am using a browser-based password manager. For most websites the login workflow is:
Go to login page. Both username and password field are visible.
Credentials are auto-filled by password manager. ...
1
vote
3answers
93 views
Should keyboard suggestion bar be enabled when typing password?
Some apps have keyboards suggestion bar, like on the picture below, enabled on password fields.
Is it a good UX or security practice to have suggestions while typing existing or creating a new ...
0
votes
1answer
71 views
Is Google using the password show/hide toggle icon on their login form correctly? [duplicate]
Shouldn’t the icon be the action that will happen after you click/press on it? ...similar to when a video or song is playing, the icon showing is “Pause” (future state), and when it is paused, the “...
2
votes
1answer
48 views
Example workflow when changing a site's identify provider
I'm switching a site from ADFS/AD to Azure B2C/AAD and require users to reset their password. Users will also see different log in screens. I'm struggling to find an approach where users won't be ...
5
votes
2answers
193 views
Perceived security of magic link/passwordless login
As far as I've read, passwordless login like Slack uses (user inputs their email and then clicks on the login link in their email) is becoming more common and is just as secure as logins that require ...
0
votes
2answers
65 views
How to prompt existing customers to change their email
I'm looking for some UX examples to how other companies have handled this situation:
Scenario:
Devs are using an old password encrypting method (sha1) I believe and need to change it to a more secure ...
-1
votes
1answer
56 views
Error message in login
In the login page of my software, there are 3 input fields - organization, username, and password.
There isn't an option to register, but the registration is done by the organization manager.
...
3
votes
1answer
112 views
Login form: User ID and Password in same page vs User ID in the first page and password in the next [duplicate]
Some major sites like Google and Amazon take 2-page approach for signin. They first ask for ID and in the next page ask for password.
What is the advantage in this against single page signin process?
...
2
votes
3answers
119 views
When does it make sense to re-prompt a user for their password, for security reasons?
For a consumer product where a customer has an account, and receives invoices from us ($10k+), and is asked to pay those invoices using a saved payment method (bank or credit card) -- we are debating ...
1
vote
0answers
102 views
Resetting password as software company staff admin (not user admin)
I'm building a tool for users to manage their account which includes user licenses and admin levels for teams (think like Adobe Cloud), but also an admin for our staff tech fix account issues. On the ...
0
votes
2answers
53 views
Security regarding user's saved card information
so I'm creating an app that allows users to pay for a product with a bank card. If the user decides to save his card information I would like the user to access that information in a way that he could ...
0
votes
0answers
59 views
Is there any advantage to bringing the user in-app for reset password vs in a browser?
Is there any notable difference between bringing the user to a browser to 'reset password' vs bringing them back to the app to do the reset? Considering that this platform exists as an app and as a ...
0
votes
2answers
66 views
Mobile log-in: how to divide two types of user logins and two methods of logging in?
So I'm designing a modile/table log in page. There are two types of users who can log in because the functionalities of the application depend on what type of user they are. Employees and managers.
...
0
votes
1answer
83 views
Best way to show password in case of Unshowing password field? [closed]
I'm developing a Desktop JavaFX application using ControlFX. I have a problem that CustomPasswordField can not show password text instead of points (PasswordField limitation ), it needs some custom ...
1
vote
1answer
83 views
Second level navigation drawer
Situation: I have second level navigation drawer. 1st level is with 3 cards (LDAP configuration, LDAP encryption, LDAP authentification). On the second level(LDAP configuration) there are no cards, ...
0
votes
1answer
99 views
Reset password with MFA
I need to implement a reset password feature with MFA. The plan is to use these 2 factors: ask a security qs and email/sms a code to the user.
I think the order of these should be answer qs---> send ...
1
vote
1answer
53 views
Use native keypad or custom one in web application
I'm tasked to implement a code entry view which allows you to enter a 6-digit code. The UI runs in the browser (JS/HTML/CSS), mobile touch devices only.
I'm stuck on how to implement this, basically ...
0
votes
1answer
61 views
Should the password field be cleared if there's a connection error?
I have a desktop application which has 3 fields for logging in: Username, Password, and Server URL.
After reading similar questions, I've decided that my application will reset the password field if ...
0
votes
4answers
98 views
When is a good time to set a Pincode?
I'm working on a Mobile Wallet for Android that hast the following sign up flow:
1) Download and install
2) Opening screen
3) Enter Phone number
4) Phone number verification (...
1
vote
2answers
120 views
Password Restrictions vs No Restrictions
When a user is presented with a password creation form of any kind, is it necessary to add parameters to their password so it meets certain security requirements (complexity etc)? These parameters ...
2
votes
2answers
476 views
Changing password: Verify with old password, verify by email, or don't verify?
Scenario
I want to change my password.
I have access to my account, this is not a forgotten password journey.
I've seen three approaches to this.
Method 1: Re-verify with old password
Log on
...
3
votes
1answer
127 views
Studies on Sign In Authentication Error Messages
So, after browsing other threads, I found some information on the question of when a user is logging in, and fails to authenticate do we give the user the message "Username or Password is incorrect" ...
3
votes
1answer
191 views
Is the Mac’s “Wrong Password” gesture universally understood? [closed]
When an incorrect password is entered into an Apple Mac’s login prompt, the dialog gently shakes as if the operating system is shaking its head at you.
This is a delightfully intuitive way to ...
1
vote
1answer
731 views
Show or hide password - icon or textual?
Allowing the user to toggle visibility is becoming a more standardised part of forms, and in my opinion for good reason. I'm however unsure what the best way to denote this ability is; an icon or a ...
3
votes
1answer
121 views
Change Password Control
My idea of manage password section is to enable only Current password field at first. If the user enters correct password in the field only then the fields beneath it would go in enable state. Would ...
3
votes
1answer
83 views
What is the name for the pattern of requiring the user to enter their password again to access high value profile information (billing, email)?
Many sites leave the user logged in for typical tasks but require the password to be entered again for certain high-value screens if it's been too long since the user authenticated with username and ...
0
votes
1answer
398 views
Which is the better UX for a user to see their password at the sign up form? (default state)
Regarding the login forms, it is advised to hide the password as default and providing the option to the users to view it in case they need to.
When it comes to registration forms though that the ...
2
votes
2answers
127 views
Are there examples of reminders for recent password changes?
Often due to security policies implemented in some organisations or software applications, users are required to change their password after a certain number of days.
Usually when you have been ...
24
votes
9answers
7k views
Reducing Password Complexity?
Since starting my new role I've found that 20% of log in sessions are resulting in a dropout.
From watching user recordings, I believe this is down to users forgetting their password. Users log in ...
0
votes
1answer
3k views
Username & Password min and max length [duplicate]
We are in the process of creating a web game where username is part of a user profile from the get go. This username will be visible to the user within the main game screen and also in the leader-...
4
votes
1answer
168 views
How do you set up username/password for another user without sending user a temporary password in email?
We have a system where an employer will register a user to our system. Employer has the persons name, and email address. The system creates a new account and an email is sent to the new user with a ...
0
votes
2answers
123 views
Should I create a password pattern or shouldn't I?
I am just creating a registration form for my website. However, I can't decide wether to go the secure or the user-friendly way.
I've got two options:
The used password must fit into a pattern
This ...
11
votes
2answers
2k views
“Forgot password?” or “Reset password”?
We're designing a minimalist login page that follows Google's Material design guidelines.
Near the password field, there is an icon with a link to the Reset password page. For such link, what name is ...
2
votes
1answer
110 views
The correct way to figure out how to solve my “forgot password” screen
My client says that is mandatory to send a code, so the developers suggest this screen where you have "mail field" for the code to be send, but besides that you have "code field". Both of them with ...
3
votes
2answers
404 views
Appropriate error message for blacklisted password!
To provide the context, we have updated our password policies to disallow commonly used passwords like “Password1”, “Welcome123”, football teams, first names and easy to type keyboard sequences etc. ...
8
votes
2answers
548 views
What percentage of internet users save credentials in the browser?
I'm trying to get a high-level understanding of what percentage of internet users allow their browser to store the username/password so I can understand the potential impact "breaking" this will have ...
4
votes
1answer
324 views
Why OTP password fields are masked?
If purpose of OTP (One Time Password) is for temporary basis, then what purpose does it serve by keeping OTP fields masked?
Even if anyone can view that password while user is typing it, IMO there ...
3
votes
1answer
573 views
more user friendly password reset process
Am writing a software to help my uncle with invoice creation. It has a login interface and each of his employees is supposed to have a cashier id. I was thinking how the best mechanism the cashier ...
-1
votes
2answers
112 views
Why people delete complete password field if only single character is missed? [duplicate]
Including me, I have noticed it many times, people tends to delete complete password field even if they miss single character.
Anyone know why users are tend to behave in such a way? Can we do ...
8
votes
5answers
575 views
Do we really need to remember all the passwords?
I'm just wondering if we really need to remember or note down all the passwords we use for sheer amount of applications nowadays. Why can't a user just click on forgot password every time he wants to ...
4
votes
2answers
167 views
Is there a standard for distributing permission for account creation?
I am creating a web app that will require the user to have an account to access, but I am not allowing people to create accounts freely. I want to give specific people permission to a pre-existing ...
2
votes
2answers
2k views
Confirm password registration prompt in mobile application
Is it a good practice to prompt user to fill field 'Confirm password' on registration screen in mobile application?
Could you tell pros/cons?
Thanks!
1
vote
5answers
237 views
How to prevent user form entering password to next to password field?
Being long time internet users I tend to fill forms barely looking at field labels, especially if it is as common and seemingly predictable as registration form. It often leads me into entering ...
2
votes
2answers
121 views
Necessary to force the user to differ the new password from the old one?
I need to rewrite our password change dialog currently. It's designed to check whether the old password differs from the new password.
Old password: something
New password: something
New password ...
0
votes
1answer
352 views
User must change password but changing username its optional. Best UX design for this?
i have to design a page where the user (after login for first time) must change the password but its optional to change the username. I am not sure which is the best approach from UX perspective, if ...
6
votes
5answers
875 views
Lets the user set the password itself or send them one via mail after registration?
I have to built an order process for an energy provider. The order process is very big and the user needs 10-15 minutes to complete it with all the data.
The last point is to set a password to access ...
7
votes
5answers
248 views
Improving on the abcdef password
Ok please reserve judgement on this. This is somewhere between a security and a UX question, plus it might be too broad.
I think my question can be summarised as:
What's the best way to engage a ...
13
votes
4answers
936 views
Should password field be cleared if Captcha is wrongly entered?
On registration screen there are 3 fields: Email, Password and Captcha.
User has entered valid email and password but has entered wrong Captcha.
Here an error message specific to the wrong Captcha ...
