Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [security]

How an application is kept secure to prevent unauthorized access.

-1
votes
0answers
50 views

What is best way to display a partial mobile number

Refer following links: https://www.karansaini.com/fuzzing-obfuscated-phone-numbers/ https://www.alldigitaltricks.com/wp-content/uploads/2017/12/kotak-bank-change-mobile-netbanking.png https://www....
5
votes
2answers
95 views

Perceived security of magic link/passwordless login

As far as I've read, passwordless login like Slack uses (user inputs their email and then clicks on the login link in their email) is becoming more common and is just as secure as logins that require ...
1
vote
2answers
73 views

How to Handle User Email Confirmation After User Becomes a Paying Customer And Doesn't Confirm Email

I'm rebuilding my "confirm email" system when a user signs up or changes their email. Websites like Facebook require an email be confirmed each time it is changed, so I have implemented the same. ...
0
votes
1answer
92 views

I made a minimalist webapp for public-key encryption. How can these problems with its UI/UX be addressed? [closed]

chausies.xyz/encrypt I probably don't know the first thing about UI design, so I wanted to get some more expert input. Forgive me if this is an inappropriate question to ask here. Half of my ...
0
votes
1answer
69 views

Phone number login and verification for mobile apps

Can someone shed some light on the security behind mobile phone logins on mobile apps? Uber and Lyft ask the user to login using their mobile phone, I'm assuming because it is a more unique ...
3
votes
2answers
79 views

How long should a multifactor authentication PIN be active for, via email or sms?

We are setting up Multifactor authentication for a Single Sign On project. Anytime a new device is detected, a PIN is sent to their email or sms (user chooses). How long do you suggest this PIN be ...
1
vote
3answers
114 views

When does it make sense to re-prompt a user for their password, for security reasons?

For a consumer product where a customer has an account, and receives invoices from us ($10k+), and is asked to pay those invoices using a saved payment method (bank or credit card) -- we are debating ...
0
votes
0answers
42 views

How to ask a user to verify their identity through OTP in the same flow as verifying their mobile number?

I'm working on integrating an OTP (one-time password) through SMS before a user is allowed to change their personal details. It's a banking environment, so the verification must be done regardless of ...
48
votes
7answers
9k views

Showing “this is secure” on credit card entry screen

Should I show some sort of "this site is secure" puffery (e.g. lock image, or some brief "this site is secure" boilerplate) on my credit card payment screen? If so, what should it look like? If not, ...
2
votes
4answers
125 views

Does retyping an email to confirm really mitigate errors?

I've seen a lot of sites ask for email confirmation on the page, mostly by retyping the same email. Does this reduce error rates or just infuriate users and what are the best ways to reduce errors ...
0
votes
2answers
53 views

Security regarding user's saved card information

so I'm creating an app that allows users to pay for a product with a bank card. If the user decides to save his card information I would like the user to access that information in a way that he could ...
1
vote
1answer
121 views

How to alert users to come back to a desktop app?

We are working on a financial related desktop app. The user can commit their money in an escrow for a period of time, and the user must be online about/within 24hrs before the expiration of the escrow ...
0
votes
1answer
39 views

Co-browsing support: initiated by customer or service rep?

We are currently putting together a co-browse feature for customers using web chat on our website, and the software that was purchased allows the customer to initiate a co-browse session (take control ...
2
votes
5answers
333 views

What's a polite way to ask the user to verify that they're not abusing my system?

My app is a game for kids in classrooms, and we offer a demo mode for teachers, so they can try before they buy. We've found that lots of kids are signing up for a demo so they can play the game for ...
0
votes
0answers
132 views

Best practices for user expiration on a web application

I have a web application with a simple custom made authentication mechanism. It doesn't feature two factor authentication or deactivation/locking users functionality. The application is not storing ...
0
votes
1answer
58 views

Using only phone number and 2-step verification as login

Is requiring the user to login using phone number and 2-step verification bad design? I have only seen 2-step verification as an EXTRA layer of protection, not a requirement. The only thing similar is ...
0
votes
1answer
83 views

Flow for alternate (to SMS) security verification

For our 2FA (2nd Factor Authentication) process, we default to having an SMS sent to the user's phone. This is causing issues for users who can't receive SMS messages; eg, they're overseas. The ...
1
vote
2answers
84 views

Best practice for private key backup flow on mobile

The mobile app I'm working on is using end-to-end encryption algorithm. User creates a private key to read data that is saved on the server. The key is being stored on a device and can be exported to ...
0
votes
2answers
340 views

When to sanitize (remove <script> tags) text entered by a user? [closed]

I give user a CKEditor to enter some formatted text. Next (to overcome hackers) I am going to sanitize HTML (remove scripts and like). Is it OK to store in my DB the text sanitized? (Alternatively I ...
0
votes
0answers
34 views

Devices Management / Limit Devices on mobile app

Specifically looking for a UX pattern/behavior that addresses the best way to handle device management on mobile. Ex.: user creates login credentials -> subscribe to the app (paid) -> share his ...
0
votes
4answers
92 views

When is a good time to set a Pincode?

I'm working on a Mobile Wallet for Android that hast the following sign up flow: 1) Download and install 2) Opening screen 3) Enter Phone number 4) Phone number verification (...
0
votes
1answer
69 views

What should be the Security Pattern for Wallet App?

I'm in early stages of developing an Android app for Wallet. I need to be clear about security options I should use. I have a couple of Options listed. Help choose a user-friendly option or suggest ...
2
votes
1answer
396 views

Account verification codes: Which part of the telephone number do you show users?

We will be asking our users to generate an account verification code that will be texted to them in order for them to sign in (as an alternative to emailing a password reset link). How many digits of ...
2
votes
2answers
381 views

Changing password: Verify with old password, verify by email, or don't verify?

Scenario I want to change my password. I have access to my account, this is not a forgotten password journey. I've seen three approaches to this. Method 1: Re-verify with old password Log on ...
5
votes
6answers
677 views

Verifying an account with SMS as opposed to email address

In order to be more secure we're looking into account verification. The two options are: Email address verification (Asking the user to click a link in an email sent to their account to verify the ...
1
vote
3answers
56 views

How to display a list of items when some have already been used

Our application has a security section which provides a list of users from AD and roles to be added for access to the program. Once a user is added, I'm not sure how best to display or not display ...
2
votes
3answers
668 views

Two factor authentication: expiry of sent text message

I have been asked to research expiry times of text messages sent to a user that contain a login code. In this journey a user will identify themselves on a website and then ask for a text message to ...
2
votes
2answers
156 views

How do we tell a user that when they logged in we noticed their password was insecure?

I'm not entirely certain if this belongs on Information Security or here, so if it needs moved I'll delete it and repost. An application I'm developing has a "feature" that alerts a user when a ...
0
votes
1answer
65 views

Authenticating / Validating a user, from an email/SMS invite

I'm designing a system whereby a company creates accounts for it's customers and sends an invite via email/SMS. The system contains PII, so we need to be cautious with data security. We need a ...
1
vote
2answers
92 views

what's the rationale behind 2-step installers?

First of all, I'd also like if this process has a proper name, I just named it the way I call it. What I mean with 2-step installers is those installers that will make user download an (usually small)...
4
votes
3answers
240 views

What's the reason behind not notifying users that they entered a wrong email when they recover their password?

Sorry, I was not able to formulate the title shorter. Today I stumbled across the password recovery from Dropbox. Here, users have to enter their email address and Dropbox says: If a Dropbox ...
4
votes
1answer
140 views

Updating security details on a financial app

I'm looking for help around the best practice for validating identity within an update security details flow. I am working on the sign-up, login, and updating process for a new web based financial ...
1
vote
1answer
149 views

Progressive disclosure login and security

More and more web sites are using the UX pattern "progressive disclosure" for login purposes. I understand that this is for better user experience and cleaner user interfaces. Since I use my browser (...
4
votes
1answer
458 views

Show user 'Access denied' page or redirect to landing page

When authenticated user in a particular role is trying to access a page (by manually typing URL) to which the user's role does not have permission: It is better to show an access denied page or ...
0
votes
0answers
51 views

Security concept for a wiki-like app

I created a wiki-like application. Currently, there is no security, so all the contents have "edit"-buttons where the user can edit everything. Now, i want my application to have a public read-only ...
0
votes
1answer
72 views

Should additional animations be shown *after* the first app-app transition?

On a new iOS device, when I try to open a special URL (app URL, universal link, or phone number), iOS will ask me if I want to "Open in X app" When this occurs, a visual animation occurs that ...
9
votes
10answers
574 views

How to best implement “check-in” feature of rewards app

I'm creating a rewards app that relies heavily on a check-in feature. Essentially, if the user checks in it adds to the users "check in count", the more they get the better the rewards such as a ...
2
votes
3answers
442 views

Two factor authentication in a single form

We are working on implementing a Google two factor authentication in our app. Each customer can turn 2FA on and off for their users in app settings. There was an idea to tweak this functionality. We ...
5
votes
1answer
728 views

Android: Why do I have to unlock my phone to turn off WiFi?

When swiping down the notification bar on Android, you are receiving a selection of buttons which offer you quick access to toggle various functionalities of the phone like turn on/off wifi, toggle ...
3
votes
1answer
120 views

When using embedded browser authentication, how can I increase user trust?

I have run into this situation before but I will speak specifically about a current project, since it is a good example. I am building a desktop application that uses the Stack Exchange API, and ...
0
votes
1answer
79 views

How to gamify security page? [closed]

I need some idea to gamify security page in my account section to urge user to make use of all products that are offer to them such as 2 pin verification, password strength and others. It will ...
1
vote
2answers
127 views

Smart door locks better UX?

There are many companies now producing 'smart' locks that allow you to open and close your front door lock, from anywhere in the world. The main feature seems to be the door recognising you when you'...
4
votes
1answer
293 views

Why OTP password fields are masked?

If purpose of OTP (One Time Password) is for temporary basis, then what purpose does it serve by keeping OTP fields masked? Even if anyone can view that password while user is typing it, IMO there ...
0
votes
1answer
86 views

How do I ask existing users for backup email for password recovery?

So after doing some research on account recovery/lost password best practices we decided to require a backup email account for password reset. That's easy enough for new users, but I'm unsure how to ...
-1
votes
2answers
112 views

Why people delete complete password field if only single character is missed? [duplicate]

Including me, I have noticed it many times, people tends to delete complete password field even if they miss single character. Anyone know why users are tend to behave in such a way? Can we do ...
8
votes
5answers
574 views

Do we really need to remember all the passwords?

I'm just wondering if we really need to remember or note down all the passwords we use for sheer amount of applications nowadays. Why can't a user just click on forgot password every time he wants to ...
1
vote
1answer
107 views

How long before system timeout should a warning appear?

On a service which includes a lot of sensitive info in digital input forms, how long before timeout should you display a warning message? Someone proposed a 15 minute session with a timeout warning ...
1
vote
2answers
63 views

Undesired change of application focus by the OS

Some desktop Operating System (OS) do spontaneously switch focus among applications without the user being aware of it. A typical issue is when you are typing in text editor and suddenly another app ...
0
votes
2answers
108 views

New user registering with an existing e-mail

Suppose that a new user goes to register on a site and enters an existing e-mail address. What message should be presented to that user from a UX point of view? Bear in mind that in the above case(as ...
4
votes
2answers
125 views

Do “text seals” increase conversions on payment forms?

Generally, studies find that having trust seals like Norton or Verisign increase conversions on credit card entry forms. Is there any evidence that homebrew "text seals" do the same when compared to ...