Skip to main content
Share Your Experience: Take the 2024 Developer Survey

Questions tagged [security]

How an application is kept secure to prevent unauthorized access.

Filter by
Sorted by
Tagged with
0 votes
1 answer
130 views

What is the best approach on recovering your login account if being hacked or logged in by different user

I'm a beginner in terms of UX. Your thoughts are highly appreciated. I love to discuss related to security with regards to a personal account on the mobile app that contains sensitive or important ...
2 votes
3 answers
216 views

How can companies mitigate the risks of PIN Codes guessing

So while I was driving, my wife was asked by her banking app to set up a 6 digits PIN Code. She immediately thought out loud : "Hmm... 6 digits ? I'm going to use the start of my phone number.&...
3 votes
2 answers
113 views

Best practices when a user with unverified email forgets the password and tries to register again or reset the password

In our system, users must confirm their emails on new registration and we send confirmation emails. We also don't show explicitly whether an email is banned, taken, or wrongly submitted on the ...
3 votes
3 answers
6k views

Two factor authentication: expiry of sent text message

I have been asked to research expiry times of text messages sent to a user that contain a login code. In this journey a user will identify themselves on a website and then ask for a text message to ...
2 votes
1 answer
3k views

Phone number login and verification for mobile apps

Can someone shed some light on the security behind mobile phone logins on mobile apps? Uber and Lyft ask the user to login using their mobile phone, I'm assuming because it is a more unique ...
2 votes
2 answers
61 views

What should the default 2FA method be for a user opening an account?

Our application (investment solution) asks users to set up a 2FA method after setting their password during onboarding. We offer multiple methods of 2FA; memorable questions, text message security, ...
2 votes
3 answers
105 views

Does onboarding include sign up?

I'm designing a matchmaking platform for influencers and marketers. I want to create a secure platform that verifies identities (both influencers, and marketers that work for legit brands). I am ...
0 votes
2 answers
160 views

How do I ask existing users for backup email for password recovery?

So after doing some research on account recovery/lost password best practices we decided to require a backup email account for password reset. That's easy enough for new users, but I'm unsure how to ...
2 votes
2 answers
156 views

Is a process secure if it's not perceived as such?

We just finished research for an article on 2FA (Two-Factor Authentication) and, while writing the report on the insights, I got wondering on this particular finding: Our research indicates that most ...
2 votes
5 answers
2k views

How to make a user feel secure when using an iframe for payments

I've got a site where it's very difficult for me to add SSL, so I'm using a secure iframe on the payment page to collect credit card details. Currently it's set up to appear like it's the same site. ...
2 votes
1 answer
111 views

When it's undetermined, what should go first: login or signup?

Context The following situation occurs when users initiate a process that requires an account to complete. They are prompted to log in. In this particular scenario, the response should be quite ...
9 votes
5 answers
2k views

Perceived security of magic link/passwordless login

As far as I've read, passwordless login like Slack uses (user inputs their email and then clicks on the login link in their email) is becoming more common and is just as secure as logins that require ...
0 votes
4 answers
9k views

Why do some cars only have a physical lock on the driver side?

I have a car (tsx) and I realize that sometimes I will need to use the physical key instead of the electronic key fob to unlock my car. Such as if there is something wrong with the electronics or my ...
3 votes
3 answers
944 views

I am losing many users due to them not verifying their email address. What is another solution?

I have a website and an application where a user can register. When they do, an email is sent to them with a link with a token attached (The token is stored in the database). For my platform users ...
0 votes
2 answers
147 views

Why should "forgot password" page open in the same tab?

I am tasked with making the login functionality for a website. Only working on the UI for now. The "forgot password" page asks for the user's email address, sends it to the backend, which ...
2 votes
2 answers
208 views

Building location based mobile app, how to handle when the user declines to enable location services?

I'm building a location based mobile app and I want users to share their location with me. However, I'm a bit torn on how to proceed when the user declines to share their location. Similar to Tinder ...
2 votes
1 answer
448 views

Should inline form validation error messages be specific or unspecific on login screens?

I had designed a message reading "Incorrect password" appearing on the 'Password' input field, however, a PM has given me feedback that saying: "I believe the common practice for ...
46 votes
6 answers
9k views

Should a user be logged in after resetting their password?

Lets assume following flow: I want to log in I don't remember password I click on the "forgot my password" link (email is dispatched) I check my inbox and click on the link I type in a new password ...
9 votes
4 answers
8k views

How many incorrect attempts should be allowed before invalidating a password?

I am trying to prevent brute force attacks on a user's account by invalidating a password when too many attempts are made in the same minute, hour, day or something similar. The credentials in this ...
14 votes
6 answers
11k views

Correct length for login timeout?

My company has created lots of computer software but one issue we have is with login timeouts. Some developers want to make them shorter for security, while most users want it be infinite? Is there ...
0 votes
1 answer
378 views

is enable Google reCAPTCHA for e-commerce good or not?

I am opening anew e-commerce website, my question is is enable Google reCAPTCHA user friendly or not? actually,I am planing to disable reCAPTCH for users for the first three months that will make ...
21 votes
7 answers
32k views

Should we ask for name on card even though it's not required for credit card payments?

The name on card is not used when processing credit card payments. Paypal does not ask the user to enter the name on card when saving a card to the "wallet", while Amazon.com does. The benefit of ...
1 vote
1 answer
107 views

Should i use a single or double page to edit a password?

I was wondering about changing a password in an application. Is it more correct to ask as usual, all three (old, new and confirm) passwords on the same page or is it better to ask for the old password ...
3 votes
1 answer
237 views

How do security puzzles affect User Experience?

Are there any studies on these kinds of security puzzles and how they affect the user experience, for bad or for good? I'm specially interested in accessibility issues and also if you know about ...
0 votes
2 answers
268 views

2FA into the login page (without email or phone number)

I have a question regarding UX of the 2nd factor authentication (2FA) process. It is common in the authentication process to ask for user id (commonly email) + password, and in a second step ask for ...
28 votes
9 answers
8k views

How to handle "forgot password" when user has not confirmed email?

If you follow the pattern of allowing users access to your application without having confirmed an email (generally considered good UX), how do handle the case where they forgot their password? Very ...
7 votes
5 answers
3k views

How best to securely present personal info in a members account page

I’m currently working on a utilities site for which signed up customers can access their personal information by means of an Account Page i.e. name, home address, email address, tel no. , billing info,...
50 votes
7 answers
12k views

Showing "this is secure" on credit card entry screen

Should I show some sort of "this site is secure" puffery (e.g. lock image, or some brief "this site is secure" boilerplate) on my credit card payment screen? If so, what should it look like? If not, ...
1 vote
2 answers
130 views

Authenticated users changing personal details

We have a website where users authenticate with a username/password and also have the option of switching on two factor authentication One of the options they have in our application is to amend ...
1 vote
2 answers
216 views

How to handle forgotten PIN for kids' banking app

How should a kids' banking app handle kids forgetting their PIN? This app is just for teaching purposes. No email or account number confirmation flow would work. I'm not allowed to share too much ...
4 votes
1 answer
2k views

Why are OTP password fields masked?

If purpose of an OTP (One Time Password) is temporary usage, then what purpose is served by keeping OTP fields masked? Even if anyone can view that password while user is typing it, IMO there is no ...
72 votes
8 answers
82k views

How to tell a user their login credentials are incorrect?

When a user has entered incorrect details into a login form, is it better to tell them: The username or password you have entered is invalid. or The username you have entered is invalid (for ...
12 votes
6 answers
4k views

Login button - on homepage or separate page?

I ran across an article called Put the login on the front page, where the author wants sites to: [...]put the user name and password box somewhere obvious on the home page like the upper right ...
3 votes
2 answers
201 views

Should I verify a user's password before showing them that they are banned or just check the email?

If I ban a user from a website indefinitely (specific manual ban not automatic), and they'll never be able to appeal, should I verify the user's email and password, or show them that they're banned ...
6 votes
8 answers
8k views

Verifying an account with SMS as opposed to email address

In order to be more secure we're looking into account verification. The two options are: Email address verification (Asking the user to click a link in an email sent to their account to verify the ...
6 votes
5 answers
3k views

Users aren't allowed to reuse old passwords for security reasons. How to alleviate this pain point?

I work at a healthcare tech start up which is pretty strict about its login guidelines, largely because protecting patient and provider info is such a vital need in this industry. But while our ...
3 votes
2 answers
275 views

Should a user attempting to enter an expired 2FA Token be notified that it is expired or just say that it is invalid?

If a user attempts to login using 2FA, and they get sent an email, there are a couple of scenarios that may occur: Code is valid and not expired: log user in. Code is valid but expired. Code is ...
12 votes
3 answers
20k views

Reset password, appropriate response if email doesn't exist?

It is common on login forms to see "Email or password is incorrect" when the user types in their account details incorrectly instead of just "password is incorrect". This is, for among other reasons, ...
1 vote
4 answers
80 views

creating the correct password parameters for a site, with cc details stored

I am trying to think of the best requirements to set a password for a customer relationship management cloud software service. A credit card is stored on the site, which is only useful to the site ...
1 vote
1 answer
56 views

In a context of a security code is PIN an abbreviation?

A 4-6 digit code is frequently used as a replacement to username and password to quickly return users into the application. It is usually referred to as pin. I began to wonder whether the correct ...
2 votes
3 answers
225 views

Best practice for private key backup flow on mobile

The mobile app I'm working on is using end-to-end encryption algorithm. User creates a private key to read data that is saved on the server. The key is being stored on a device and can be exported to ...
1 vote
1 answer
457 views

Asking user to login to another website from within my app

I am working on an app which requires me to interact with an external API from an external website on behalf of the user. For this I need to ask them for their credentials for this other API. Will ...
3 votes
2 answers
2k views

Best practice for two-factor authentication process

Perhaps due to the recent incidents behind hacking of user database and identity theft, many organizations have introduced the two-factor authentication process, in particular when users are accessing ...
2 votes
1 answer
119 views

Co-browsing support: initiated by customer or service rep?

We are currently putting together a co-browse feature for customers using web chat on our website, and the software that was purchased allows the customer to initiate a co-browse session (take control ...
14 votes
4 answers
9k views

Stop user opening links in a new tab

On a secure site, is it OK to stop users from opening a link in a new tab by signing them out? I have a mobile games web-app and my users can only play one at a time. To avoid issues of them trying ...
4 votes
5 answers
299 views

Security issues if not forcing a user to sign up

I've built a simple web app Flask.io that enables users to create and share to-do lists. It doesn't require sign up. This is an important differentiator. I don't want to force the user to register ...
1 vote
3 answers
1k views

Why is password confirmation common in password resets and updates? [duplicate]

I've seen multiple websites with only one field for the password during registration, whereas there are two fields – Enter Password and Confirm Password – for password reset and update tasks.
3 votes
1 answer
3k views

Account verification codes: Which part of the telephone number do you show users?

We will be asking our users to generate an account verification code that will be texted to them in order for them to sign in (as an alternative to emailing a password reset link). How many digits of ...
1 vote
2 answers
267 views

What would be the success criteria for user testing for 2FA authentication

i'm conducting a user testing session for a few prototypes. one of the prototypes of a feature i'll be testing is the 2 factor authentication. Compared to other features which have more of an ...
0 votes
4 answers
279 views

At what step in the user flow of a travel booking app would 2FA OTP be needed

i'm designing a 2FA OPT feature for an app that lets users book flights and trains. As users are able to store personal information including their payment details, this level of verification is ...

1
2 3 4 5