Questions tagged [password]
A secret word or string of characters that is used for authentication, to prove identity or gain access to a resource.
250 questions
0
votes
3
answers
178
views
Is there an accepted standard for passwords?
It's frustrating how some websites require symbols while some don't allow them, some require a capital or number while others don't, some don't allow the same consecutive characters, etc.
Every once ...
- 659
13
votes
2
answers
2k
views
Why not show password criteria on login screen?
I have frequently bumped into this issue: sites ask for my password (e.g. Stack Exchange itself) when I want to do something like updating my profile.
This is per se a low priority site for me so I ...
- 133
2
votes
2
answers
123
views
Should users be given the option to sign up to a website without having to set a password?
For many sites as a user I'm not really bothered about security as there's little of value on the site
So should users be given the option of signing up to a website without setting a password ?
- 11.3k
9
votes
4
answers
8k
views
How many incorrect attempts should be allowed before invalidating a password?
I am trying to prevent brute force attacks on a user's account by invalidating a password when too many attempts are made in the same minute, hour, day or something similar. The credentials in this ...
18
votes
4
answers
8k
views
Which is the better UX for a user to see their password at the login screen?
These are the two options I'm considering.
Having a tickbox for a 'show password' option, which would let the user see their password. A 'caps lock' icon would be in the password text area which ...
- 281
5
votes
1
answer
213
views
Is there any research into whether/how people save username/password combinations?
It's something of an open secret that many people don't handle the security of their accounts online in the same way the designers of such systems would want them to. This is why we often see text ...
- 23.9k
78
votes
10
answers
28k
views
Should users be allowed to use any special character they want when creating a password?
I came across a number of login configuration settings where there is a list of allowable special characters and was wondering:
Does this limitation cater for a specific security or usability need?
...
- 7,026
7
votes
8
answers
358
views
Is it a good idea to expire passwords after a time relative to their complexity?
Is it a good idea to expire passwords after a time relative to their complexity? Is it a good way to teach users to use secure passwords? (relevant xkcd: correct horse battery staple)
I'm thinking of ...
- 1,180
17
votes
9
answers
9k
views
Should password reset functionality email a temporary password or just a reset link?
When a user submits a reset password form, which UX is preferred?
A temporary password is created for them to use. It's emailed to them. They log in and then a permanent change password form is shown....
- 961
2
votes
4
answers
777
views
Is it ever useful to show the Password Requirements on page load?
I have a hypothesis that I have no idea how to test other than lots of observational testing, but perhaps someone has covered this already.
On signing up to a new service and being presented with the ...
JonW♦
- 37.6k
105
votes
13
answers
17k
views
Should passwords expire?
I have a dispute with my partner. He comes from a financial software background but I do not. He recommends that our web app should expire user's passwords after 6 months (and it has to be unique each ...
- 961
1
vote
0
answers
197
views
Any suggestions for letting user Activation by clicking link OR typing in confirmation code?
Sometimes, our users do not have access to their email on the same device they are using our web app on, for example, they can check their email on their iphone, but the iphone is too small to use ...
- 1,548
1
vote
1
answer
577
views
Inform user of invalid email on password reset
Should the user be told if they enter an email which is not in the database?
User forgets their password and clicks a link to reset it.
Page displays "An email was just sent out to [email protected] ...
- 1,061
1
vote
2
answers
130
views
Should I use multiple '*' when typing in one character?
I am designing a secure password login page. I am thinking about outputting multiple * for one typed character.
For example:
User types: a
Password field shows: ******
My rationale for this is ...
- 113
1
vote
2
answers
201
views
Any evidence password strength indicators break user journey?
Have any studies been conducted on whether password strength indicators break user journey's. Here is a hypothetical scenario:
As a customer of an eCommerce website, I am ready to make a purchase ...
- 1,208
3
votes
4
answers
242
views
What is the best way to ask users for multiple passwords?
I am creating an app which includes payments and by following banking regulations I need to ask the users for a four-digit password as well as an OTP (one-time PIN sent to the user's phone) every time ...
- 1,401
0
votes
1
answer
141
views
Are there any good guidelines to how many passwords a user can safely remember?
In an ideal world we each would have one password to remember, and that would be a strong password and we would change it every month or so. But we don't live in an ideal world, and we have to access ...
- 1,547
4
votes
5
answers
2k
views
When should I validate that the password in a confirmation field matches the first password entered?
If a user creation page has a field where you are asked to re-enter your password, when should the page validate that the second password matches the first?
I do not have control over whether or not ...
- 253
2
votes
1
answer
1k
views
Automatic login on password reset
This question has been raised on https://security.stackexchange.com/questions/40723/why-do-you-need-to-login-after-you-change-a-password
- With security in mind
As one user states: "From a security ...
- 502
-1
votes
1
answer
193
views
Username & Password for selling page Yes or No?
I appreciate your given opinion about this:
I intend to send an email to a specific target audience in order to offer small business owners (around the world) a product which is not cheap. (I don't ...
- 11
1
vote
4
answers
587
views
"My account" page mockup - change password form on this page?
I am mocking up a very minimalistic user-account page. It consists of just three functions - a counter that displays your available uses, field to redeem a code and a link to a form where you can ...
- 33
7
votes
2
answers
2k
views
Change Password Form
When allowing a user to change their password is it necessary to add a confirm password field?
as follows:
Current Password
New Password
Password Strength Meter
Confirm New Password (Is this field ...
- 417
2
votes
1
answer
488
views
Best practices for picture password implementation
Instead using of the conventional password design (***** in a text entry field) in my mobile application, I've been thinking about letting the user create a 4 item password from a collection of 10 ...
- 692
1
vote
2
answers
107
views
Does a crime security alert app need its users to register?
I was asked to work on a police security alert system as a school project. The app notifies a user about security info and lets users (citizens of a place) notify police agencies around them. I was ...
- 111
4
votes
1
answer
2k
views
Show special keyboard view when entering a password on mobile devices?
Mobile operating systems typically show different virtual keyboards depending on context. The default keyboard might show A-Z, while a keyboard for entering a telephone number might show 0-9 (so you ...
- 3,966
0
votes
1
answer
284
views
Security questions vs secret password/passcode when logging in or retrieving login details?
I am currently in the process of re-designing a login process which uses security questions to verify the identity of users before they are successfully logged in, and also to allow them to reset ...
- 7,026
2
votes
1
answer
166
views
Registration form inline password generation?
A client has given me "design direction" for their site's account creation form (it's a utility site) that includes an option to have the system generate a password for the user inline on the form, ...
- 31
1
vote
1
answer
170
views
"Change password", "change your password" or "pick a new password"?
I have seen these different phrases on various websites and I was wondering which one sounds warmer, more inviting and more trustworthy? Which is more user-friendly?
Personally I don't understand "...
- 233
3
votes
3
answers
447
views
Should ergonomics be added to password strength meters?
After getting locked out of my account for typing in my password incorrectly several times in a row, I realized that the password I chose is too prone to typos and has resulted in locked accounts.
It ...
- 133
0
votes
1
answer
299
views
Password recovery process: temporal password vs. change it yourself
I'm looking for analyzing if giving a temporal password when some user forgets its actual password and requires to log into an application (in my case, it's a Web application) is a good idea.
From my ...
1
vote
1
answer
372
views
Reverse and optimize the sign up process for double opt-in
The perceived majority of websites have a quite similar approach to double opt-in signups: all information required to sign up is required before sending a confirmation e-mail. The confirmation e-mail ...
- 3,897
7
votes
6
answers
1k
views
Wouldn't it be a good UX practice to give hints to users to help them remember their passwords?
Although most of the places on the internet allow users to login with their existing Google or Facebook account, there are still many places where this is not an option. In such cases, remembering ...
- 579
8
votes
5
answers
437
views
Forcing Users To think up More Complex Passwords / Ease of Remembering Them
Are there any guidelines on the play-off between forcing users to have complex passwords (longer, including numbers and special characters etc) - and the reduction in security if users therefore have ...
- 11.3k
1
vote
1
answer
2k
views
Password reset with lost email functionality
I have searched and viewed most of the other questions and answers about implementing forgot password functionality on a website.
However, we have a unique situation. When a user registers an account ...
- 361
1
vote
1
answer
446
views
What is a Design pattern for "Remember Me" that forces user to explicitly choose "remember" or "do not remember?
We have a very nontechnical user base.
We provide a "Remember Me on this computer" option (checked by default) but perhaps it should not be checked by default.
However, I want to make sure they have ...
- 1,548
1
vote
1
answer
60
views
Passwords: Speed of conversion from displayed to 'starred'
On an Android phone, passwords are automatically converted to a 'starred' format a few seconds after each character is input. However I find this happens too quickly to visually double check that I ...
- 11.3k
3
votes
5
answers
2k
views
Potential UX issues with password-less logins?
There is a fantastic article entitled Is it time for password-less login? that suggests that we could use the "reset password" link as the default login action to any site. It provides a lot of ...
- 303
0
votes
1
answer
766
views
Optional password field on login
We want all users to enter their employment ID so we can identify them, but it's not so important that we require them to register or remember a password.
Some users will be registered for the ...
- 118
2
votes
3
answers
464
views
When is the best time to ask a user to create a password?
I have seen some services ask the user to create a password on the initial signup form.
I have seen others only ask the user to create a password after clicking on a verification link sent to their ...
- 271
9
votes
2
answers
256
views
Variable Password Requirements Help
Standford University recently published a quick guide to their password requirements:
While I quite like this method and this guide is great, I can't think of a nice way to concisely express this ...
- 191
6
votes
5
answers
883
views
Should password complexity be shown at login page?
I believe most (or at least: many) users have passwords pretty much standard - they tend to use even literally the same password for most of the systems they access. This is insecure, of course, but ...
- 13.9k
40
votes
10
answers
9k
views
Is it good idea to send user password upon register?
I can imagine both ways - send / not send and still make it secure enough inside application.
For instance: I get the password from "Enter your password" field, store it in email template and then ...
- 1,559
16
votes
2
answers
18k
views
Logout after password change?
What is the convention regarding the following scenario:
In a given system, a user is already logged in. He perform some tasks and then he change his own password.
After this point, what should ...
- 375
5
votes
1
answer
3k
views
Changing password in user settings. Best method
I'm trying to think of the 'best' way for a user to change its password along with its user settings(Like name, e-mail etc.)
I've got a form like this:
Name: [text input]
E-mailaddress: [text input]
...
- 319
66
votes
21
answers
15k
views
Argument for/against splitting login process into checking username, then ask password?
My boss has insisted for a while that our login process be divided into two steps on separate pages: on the first page, ask the user's e-mail address. On the second page, either display "user found" ...
- 761
5
votes
3
answers
5k
views
Which browsers allow users to reveal passwords in password fields?
Which browsers allow users to reveal passwords in password fields?
I already know that Windows 8, Windows 8.1, Internet Explorer 10 and Internet Explorer 11 (1). Cursory research did not reveal any ...
- 1,896
12
votes
4
answers
2k
views
Allowing every password of 6+ characters. Good practice?
I am developing a file sharing and hosting service, and right now I don't have any requirements set other then that a password has to be at least 6 characters long. I also accept all characters.
I'm ...
- 414
4
votes
1
answer
328
views
Forgot password--- show the rules for that passphrase? [duplicate]
I know there's been a lot of discussion about password strength and indicators when signing up. I often find that when I forget a password for a site, its because I can't remember which set of rules ...
- 382
5
votes
3
answers
675
views
Password Complexity Requirements
Anyone has research or data that shows correlation between using password complexity requirements and sign up conversion rate?
Example of password complexity requirement:
- 3,127
41
votes
5
answers
6k
views
Does a password strength indicator increase password strength?
Just browsing the internet, I saw a password strength indicator on a sign up, and I realized that I personally didn't care. Does anyone know if, on average, password strength indicators increase the ...
- 833