Questions tagged [security]

How an application is kept secure to prevent unauthorized access.

Filter by
Sorted by
Tagged with
0 votes
1 answer
61 views

Does onboarding include sign up?

I'm designing a matchmaking platform for influencers and marketers. I want to create a secure platform that verifies identities (both influencers, and marketers that work for legit brands). I am ...
Maus's user avatar
  • 1
2 votes
3 answers
369 views

I am losing many users due to them not verifying their email address. What is another solution?

I have a website and an application where a user can register. When they do, an email is sent to them with a link with a token attached (The token is stored in the database). For my platform users ...
Talktomegoose's user avatar
0 votes
2 answers
94 views

Why should "forgot password" page open in the same tab?

I am tasked with making the login functionality for a website. Only working on the UI for now. The "forgot password" page asks for the user's email address, sends it to the backend, which ...
Aditya Patil's user avatar
2 votes
2 answers
91 views

Building location based mobile app, how to handle when the user declines to enable location services?

I'm building a location based mobile app and I want users to share their location with me. However, I'm a bit torn on how to proceed when the user declines to share their location. Similar to Tinder ...
user1354934's user avatar
2 votes
1 answer
252 views

Should inline form validation error messages be specific or unspecific on login screens?

I had designed a message reading "Incorrect password" appearing on the 'Password' input field, however, a PM has given me feedback that saying: "I believe the common practice for ...
Katie's user avatar
  • 23
0 votes
1 answer
262 views

is enable Google reCAPTCHA for e-commerce good or not?

I am opening anew e-commerce website, my question is is enable Google reCAPTCHA user friendly or not? actually,I am planing to disable reCAPTCH for users for the first three months that will make ...
Mohamad Mahmoud Darwish's user avatar
0 votes
2 answers
232 views

2FA into the login page (without email or phone number)

I have a question regarding UX of the 2nd factor authentication (2FA) process. It is common in the authentication process to ask for user id (commonly email) + password, and in a second step ask for ...
lcssanches's user avatar
1 vote
1 answer
91 views

Should i use a single or double page to edit a password?

I was wondering about changing a password in an application. Is it more correct to ask as usual, all three (old, new and confirm) passwords on the same page or is it better to ask for the old password ...
Francesco Fagioli's user avatar
3 votes
1 answer
140 views

How do security puzzles affect User Experience?

Are there any studies on these kinds of security puzzles and how they affect the user experience, for bad or for good? I'm specially interested in accessibility issues and also if you know about ...
Devin's user avatar
  • 35.2k
1 vote
2 answers
212 views

How to handle forgotten PIN for kids' banking app

How should a kids' banking app handle kids forgetting their PIN? This app is just for teaching purposes. No email or account number confirmation flow would work. I'm not allowed to share too much ...
Deep Shah's user avatar
  • 173
2 votes
3 answers
179 views

How can companies mitigate the risks of PIN Codes guessing

So while I was driving, my wife was asked by her banking app to set up a 6 digits PIN Code. She immediately thought out loud : "Hmm... 6 digits ? I'm going to use the start of my phone number.&...
Chris's user avatar
  • 4,428
3 votes
2 answers
190 views

Should a user attempting to enter an expired 2FA Token be notified that it is expired or just say that it is invalid?

If a user attempts to login using 2FA, and they get sent an email, there are a couple of scenarios that may occur: Code is valid and not expired: log user in. Code is valid but expired. Code is ...
yaserso's user avatar
  • 443
3 votes
2 answers
198 views

Should I verify a user's password before showing them that they are banned or just check the email?

If I ban a user from a website indefinitely (specific manual ban not automatic), and they'll never be able to appeal, should I verify the user's email and password, or show them that they're banned ...
yaserso's user avatar
  • 443
1 vote
4 answers
78 views

creating the correct password parameters for a site, with cc details stored

I am trying to think of the best requirements to set a password for a customer relationship management cloud software service. A credit card is stored on the site, which is only useful to the site ...
Source's user avatar
  • 2,333
1 vote
1 answer
54 views

In a context of a security code is PIN an abbreviation?

A 4-6 digit code is frequently used as a replacement to username and password to quickly return users into the application. It is usually referred to as pin. I began to wonder whether the correct ...
Allan Spreys's user avatar
1 vote
1 answer
275 views

Asking user to login to another website from within my app

I am working on an app which requires me to interact with an external API from an external website on behalf of the user. For this I need to ask them for their credentials for this other API. Will ...
user3217163's user avatar
1 vote
3 answers
752 views

Why is password confirmation common in password resets and updates? [duplicate]

I've seen multiple websites with only one field for the password during registration, whereas there are two fields – Enter Password and Confirm Password – for password reset and update tasks.
Ankit Agrawal's user avatar
1 vote
2 answers
231 views

What would be the success criteria for user testing for 2FA authentication

i'm conducting a user testing session for a few prototypes. one of the prototypes of a feature i'll be testing is the 2 factor authentication. Compared to other features which have more of an ...
Blue Ocean's user avatar
  • 10.6k
0 votes
4 answers
253 views

At what step in the user flow of a travel booking app would 2FA OTP be needed

i'm designing a 2FA OPT feature for an app that lets users book flights and trains. As users are able to store personal information including their payment details, this level of verification is ...
Blue Ocean's user avatar
  • 10.6k
3 votes
1 answer
294 views

Logging users out after 24 hours

I'm wondering if there's a specific 'standard' time for logging users out of a website that contains sensitive information and data. I am thinking that kicking them off the website in 24 hours could ...
Viktoria's user avatar
2 votes
0 answers
57 views

Does OS security equals "perceived" security for users?

While this question originated primarily in MacOS Catalina and its new security features, I want to know how security measures are leveled with UX options so poor in the user's vision. Catalina's ...
Devin's user avatar
  • 35.2k
4 votes
2 answers
205 views

What are the advantages of selfies for security?

A former client of us hired us again after 3 years. In that period, they had many changes, one of them the use of selfies for security reasons. I have found this type of security from time to time, ...
Devin's user avatar
  • 35.2k
0 votes
1 answer
112 views

What is the best approach on recovering your login account if being hacked or logged in by different user

I'm a beginner in terms of UX. Your thoughts are highly appreciated. I love to discuss related to security with regards to a personal account on the mobile app that contains sensitive or important ...
Jaime Caro's user avatar
1 vote
2 answers
126 views

Authenticated users changing personal details

We have a website where users authenticate with a username/password and also have the option of switching on two factor authentication One of the options they have in our application is to amend ...
Mike's user avatar
  • 183
6 votes
5 answers
2k views

Users aren't allowed to reuse old passwords for security reasons. How to alleviate this pain point?

I work at a healthcare tech start up which is pretty strict about its login guidelines, largely because protecting patient and provider info is such a vital need in this industry. But while our ...
Conor's user avatar
  • 533
2 votes
2 answers
363 views

Should we mask API keys?

As an authentication token, an API key is pretty much functionally identical to a password. Does it follow then that we should mask the API key, when it is entered in a settings dialog? The reason ...
amoe's user avatar
  • 123
1 vote
2 answers
128 views

Does an Administrator need a reminder about other roles?

I'm working on a UI where a site Admin can add another user role. In the mean time, we're calling this new role, "Collaborator". The Collaborator is typically a freelancer the Admin adds to help ...
J Bo's user avatar
  • 1,303
1 vote
3 answers
208 views

Should keyboard suggestion bar be enabled when typing password?

Some apps have keyboards suggestion bar, like on the picture below, enabled on password fields. Is it a good UX or security practice to have suggestions while typing existing or creating a new ...
Peter's user avatar
  • 943
2 votes
1 answer
68 views

Example workflow when changing a site's identify provider

I'm switching a site from ADFS/AD to Azure B2C/AAD and require users to reset their password. Users will also see different log in screens. I'm struggling to find an approach where users won't be ...
Kye's user avatar
  • 125
31 votes
2 answers
6k views

How to increase users' perception of security on a payment screen? [duplicate]

Has anyone done any user testing they could share about padlock or shield icons on payments screens and which is perceived as most secure?
Roger's user avatar
  • 333
4 votes
6 answers
2k views

What is best way to display a partial mobile number

Refer following links: https://www.karansaini.com/fuzzing-obfuscated-phone-numbers/ https://www.alldigitaltricks.com/wp-content/uploads/2017/12/kotak-bank-change-mobile-netbanking.png https://www....
Ankur's user avatar
  • 93
9 votes
5 answers
2k views

Perceived security of magic link/passwordless login

As far as I've read, passwordless login like Slack uses (user inputs their email and then clicks on the login link in their email) is becoming more common and is just as secure as logins that require ...
Briana's user avatar
  • 91
2 votes
2 answers
581 views

How to Handle User Email Confirmation After User Becomes a Paying Customer And Doesn't Confirm Email

I'm rebuilding my "confirm email" system when a user signs up or changes their email. Websites like Facebook require an email be confirmed each time it is changed, so I have implemented the same. ...
stwhite's user avatar
  • 121
0 votes
1 answer
144 views

I made a minimalist webapp for public-key encryption. How can these problems with its UI/UX be addressed? [closed]

chausies.xyz/encrypt I probably don't know the first thing about UI design, so I wanted to get some more expert input. Forgive me if this is an inappropriate question to ask here. Half of my ...
chausies's user avatar
  • 155
1 vote
1 answer
2k views

Phone number login and verification for mobile apps

Can someone shed some light on the security behind mobile phone logins on mobile apps? Uber and Lyft ask the user to login using their mobile phone, I'm assuming because it is a more unique ...
Camille's user avatar
  • 11
3 votes
2 answers
126 views

How long should a multifactor authentication PIN be active for, via email or sms?

We are setting up Multifactor authentication for a Single Sign On project. Anytime a new device is detected, a PIN is sent to their email or sms (user chooses). How long do you suggest this PIN be ...
UX-Indy's user avatar
  • 31
2 votes
3 answers
220 views

When does it make sense to re-prompt a user for their password, for security reasons?

For a consumer product where a customer has an account, and receives invoices from us ($10k+), and is asked to pay those invoices using a saved payment method (bank or credit card) -- we are debating ...
beastly_beast's user avatar
0 votes
0 answers
216 views

How to ask a user to verify their identity through OTP in the same flow as verifying their mobile number?

I'm working on integrating an OTP (one-time password) through SMS before a user is allowed to change their personal details. It's a banking environment, so the verification must be done regardless of ...
Wendy Wojenka's user avatar
50 votes
7 answers
11k views

Showing "this is secure" on credit card entry screen

Should I show some sort of "this site is secure" puffery (e.g. lock image, or some brief "this site is secure" boilerplate) on my credit card payment screen? If so, what should it look like? If not, ...
Jeffrey Kemp's user avatar
2 votes
4 answers
754 views

Does retyping an email to confirm really mitigate errors?

I've seen a lot of sites ask for email confirmation on the page, mostly by retyping the same email. Does this reduce error rates or just infuriate users and what are the best ways to reduce errors ...
Eliot Hill's user avatar
0 votes
2 answers
89 views

Security regarding user's saved card information

so I'm creating an app that allows users to pay for a product with a bank card. If the user decides to save his card information I would like the user to access that information in a way that he could ...
Philip RH's user avatar
  • 112
1 vote
1 answer
164 views

How to alert users to come back to a desktop app?

We are working on a financial related desktop app. The user can commit their money in an escrow for a period of time, and the user must be online about/within 24hrs before the expiration of the escrow ...
James D's user avatar
  • 11
2 votes
1 answer
116 views

Co-browsing support: initiated by customer or service rep?

We are currently putting together a co-browse feature for customers using web chat on our website, and the software that was purchased allows the customer to initiate a co-browse session (take control ...
IronBasset's user avatar
  • 1,157
2 votes
5 answers
2k views

What's a polite way to ask the user to verify that they're not abusing my system?

My app is a game for kids in classrooms, and we offer a demo mode for teachers, so they can try before they buy. We've found that lots of kids are signing up for a demo so they can play the game for ...
Joshua Frank's user avatar
0 votes
1 answer
330 views

Using only phone number and 2-step verification as login

Is requiring the user to login using phone number and 2-step verification bad design? I have only seen 2-step verification as an EXTRA layer of protection, not a requirement. The only thing similar is ...
Jessica Zhang's user avatar
0 votes
1 answer
382 views

Flow for alternate (to SMS) security verification

For our 2FA (2nd Factor Authentication) process, we default to having an SMS sent to the user's phone. This is causing issues for users who can't receive SMS messages; eg, they're overseas. The ...
Matt's user avatar
  • 1
2 votes
3 answers
215 views

Best practice for private key backup flow on mobile

The mobile app I'm working on is using end-to-end encryption algorithm. User creates a private key to read data that is saved on the server. The key is being stored on a device and can be exported to ...
Piotr Zięba's user avatar
0 votes
2 answers
1k views

When to sanitize (remove <script> tags) text entered by a user? [closed]

I give user a CKEditor to enter some formatted text. Next (to overcome hackers) I am going to sanitize HTML (remove scripts and like). Is it OK to store in my DB the text sanitized? (Alternatively I ...
porton's user avatar
  • 171
0 votes
4 answers
271 views

When is a good time to set a Pincode?

I'm working on a Mobile Wallet for Android that hast the following sign up flow: 1) Download and install 2) Opening screen 3) Enter Phone number 4) Phone number verification (...
crespi.f's user avatar
0 votes
1 answer
84 views

What should be the Security Pattern for Wallet App?

I'm in early stages of developing an Android app for Wallet. I need to be clear about security options I should use. I have a couple of Options listed. Help choose a user-friendly option or suggest ...
Zaryab Waseem's user avatar

1
2 3 4 5