Skip to main content
Share Your Experience: Take the 2024 Developer Survey

Questions tagged [security]

How an application is kept secure to prevent unauthorized access.

Filter by
Sorted by
Tagged with
72 votes
8 answers

How to tell a user their login credentials are incorrect?

When a user has entered incorrect details into a login form, is it better to tell them: The username or password you have entered is invalid. or The username you have entered is invalid (for ...
F21's user avatar
  • 5,918
55 votes
10 answers

What is the best way to inspire users to choose strong password?

Most of the users use weak passwords. They may use weak passwords even for services where they store sensitive information. I think it's because they don't believe that their password may be guessed/...
Andrei Botalov's user avatar
60 votes
10 answers

Refusing a user permission to click a URL

I've been asked to work on a system message on an intranet where by there are various URLs (linking to lists of content) that have permission rights attached to them, so only certain users have access ...
Spiral13's user avatar
  • 2,164
50 votes
7 answers

Showing "this is secure" on credit card entry screen

Should I show some sort of "this site is secure" puffery (e.g. lock image, or some brief "this site is secure" boilerplate) on my credit card payment screen? If so, what should it look like? If not, ...
Jeffrey Kemp's user avatar
41 votes
5 answers

Does a password strength indicator increase password strength?

Just browsing the internet, I saw a password strength indicator on a sign up, and I realized that I personally didn't care. Does anyone know if, on average, password strength indicators increase the ...
OneChillDude's user avatar
30 votes
6 answers

Forcing users to use a particular pattern for passwords

Many websites, specially government ones, enforce users to use a password which conforms to particular criteria. For example: use between 8-13 characters with at-least one integer and one capital ...
Salman Ehsan's user avatar
  • 4,951
14 votes
6 answers

Correct length for login timeout?

My company has created lots of computer software but one issue we have is with login timeouts. Some developers want to make them shorter for security, while most users want it be infinite? Is there ...
Musaab's user avatar
  • 423
13 votes
2 answers

Why would one limit username format?

Many websites when ask you to create a new "username", will limit you in some way, most often like "username should only contain letters and underscores" or something alike. This results in inability ...
Igor Romanov's user avatar
8 votes
5 answers

Forgotten Passwords - is there a real benefit to asking for memorable password hints on signup?

On several signup forms I see fields such as "Choose your Memorable Password Question". Is this actually benifical nowadays? Surely a more secure method if someone forgets their password is to build a ...
JonW's user avatar
  • 37.4k
104 votes
13 answers

Should passwords expire?

I have a dispute with my partner. He comes from a financial software background but I do not. He recommends that our web app should expire user's passwords after 6 months (and it has to be unique each ...
jrjensen's user avatar
  • 951
56 votes
11 answers

"Typocaptcha" - an alternative to CAPTCHA? [closed]

We all hate CAPTCHAs, but to some applications they're a necessary evil. Today I wondered if there's a better alternative we just haven't thought of yet. I considered the dilemma: how do you create ...
rybo111's user avatar
  • 1,069
28 votes
9 answers

How to handle "forgot password" when user has not confirmed email?

If you follow the pattern of allowing users access to your application without having confirmed an email (generally considered good UX), how do handle the case where they forgot their password? Very ...
cminu's user avatar
  • 281
21 votes
7 answers

Should we ask for name on card even though it's not required for credit card payments?

The name on card is not used when processing credit card payments. Paypal does not ask the user to enter the name on card when saving a card to the "wallet", while does. The benefit of ...
F21's user avatar
  • 5,918
12 votes
3 answers

Reset password, appropriate response if email doesn't exist?

It is common on login forms to see "Email or password is incorrect" when the user types in their account details incorrectly instead of just "password is incorrect". This is, for among other reasons, ...
DasBeasto's user avatar
  • 15.3k
12 votes
6 answers

Login button - on homepage or separate page?

I ran across an article called Put the login on the front page, where the author wants sites to: [...]put the user name and password box somewhere obvious on the home page like the upper right ...
John C's user avatar
  • 324
11 votes
3 answers

Should I capture exceptions and present a nice error page to hackers? [closed]

If a hacker is trying to hack, should I present a pretty error page or redirect somewhere instead of a generic/cryptic error? I feel that the hacker knows what they are doing, I know what they are ...
Chloe's user avatar
  • 797
11 votes
4 answers

When is it right to use "Not <user>?"

Sometimes a site shows a message reading: "You are logged in as [user1]. Not [user1]? Please log out." When is it right to use such a thing? Where are we assuming someone is mistakenly logged in as ...
JNF's user avatar
  • 173
11 votes
5 answers

Does SSL on a company's website make the company appear more credible?

I recently had a thought about the way many modern browsers display information about a site's security certificates. At least Firefox shows a very noticeable blue box in the address bar on sites that ...
Kaivosukeltaja's user avatar
10 votes
3 answers

Usability and security for user access and password handling in a web application?

I'm looking at putting together a website aimed at ordinary users that will handle personal data which I don't want to be compromised. How can I make the site secure but also usable? It seems most ...
glenatron's user avatar
  • 203
10 votes
3 answers

Why did they use two-stage social media sharing buttons?

I recently visited a seemingly fairly reputable web site and was astonished to see their implementation of a two-stage trigger for their social media buttons: (The text appears when you hover over ...
msanford's user avatar
  • 5,995
9 votes
4 answers

How many incorrect attempts should be allowed before invalidating a password?

I am trying to prevent brute force attacks on a user's account by invalidating a password when too many attempts are made in the same minute, hour, day or something similar. The credentials in this ...
Alexandre Martins's user avatar
8 votes
3 answers

Has Captcha become common knowledge?

I am doing a business site for a web company, and was wondering if Captcha has become so well-known, that it no longer needs an explanation ? Right now there is only a input box, the captcha image ...
Nils Munch's user avatar
7 votes
3 answers

Accessing secure content

Which of the permutations for accessing secure content do folks prefer? In this instance I'm referring to a saved quote and have usernames, email addresses and quote reference numbers available. E.g:...
user avatar
7 votes
1 answer

Usable examples, recommended practices for interfaces optimized for using pass-phrases instead of passwords

Reading through What is the best way to inspire users to choose strong password?, I realized I have never used an interface where the primary login password system would use pass-phrases (and where ...
peteorpeter's user avatar
  • 3,239
4 votes
2 answers

How does the perception of website data being insecure affect usability?

If the user perceives that data entered into a website is insecure (if it is perceived that it can be hacked, stolen or tampered with), how is the usability of the site affected? This question is in ...
gurvinder372's user avatar
  • 2,205
4 votes
5 answers

Security issues if not forcing a user to sign up

I've built a simple web app that enables users to create and share to-do lists. It doesn't require sign up. This is an important differentiator. I don't want to force the user to register ...
Lee's user avatar
  • 563
3 votes
2 answers

Should confirm email links autologin if the user is not logged in?

I am working on a system where the administrator can configure the following behaviour for email addresses: Allow users to attach multiple email addresses to their account (just like Facebook and ...
F21's user avatar
  • 5,918
2 votes
1 answer

What's the best way to handle password reset requests where the user hasn't registered with the entered email address

Within a secure password reset function of a web application where the email address is the unique account identifier, what would be the best way to handle password reset requests where no matching ...
Harley B's user avatar
  • 133