Questions tagged [security]

How an application is kept secure to prevent unauthorized access.

Filter by
Sorted by
Tagged with
103 votes
13 answers
16k views

Should passwords expire?

I have a dispute with my partner. He comes from a financial software background but I do not. He recommends that our web app should expire user's passwords after 6 months (and it has to be unique each ...
jrjensen's user avatar
  • 941
70 votes
8 answers
81k views

How to tell a user their login credentials are incorrect?

When a user has entered incorrect details into a login form, is it better to tell them: The username or password you have entered is invalid. or The username you have entered is invalid (for ...
F21's user avatar
  • 5,888
64 votes
3 answers
9k views

Why do some websites (including Google) trim whitespaces in passwords?

I have just noticed that Google as well as some other sites trims the whitespaces in the password. I can successfully sign into my google account even if I add extra spaces in the end of my password. ...
Chip Zhang's user avatar
59 votes
10 answers
5k views

Refusing a user permission to click a URL

I've been asked to work on a system message on an intranet where by there are various URLs (linking to lists of content) that have permission rights attached to them, so only certain users have access ...
Spiral13's user avatar
  • 2,154
55 votes
11 answers
10k views

"Typocaptcha" - an alternative to CAPTCHA? [closed]

We all hate CAPTCHAs, but to some applications they're a necessary evil. Today I wondered if there's a better alternative we just haven't thought of yet. I considered the dilemma: how do you create ...
rybo111's user avatar
  • 1,049
54 votes
10 answers
5k views

What is the best way to inspire users to choose strong password?

Most of the users use weak passwords. They may use weak passwords even for services where they store sensitive information. I think it's because they don't believe that their password may be guessed/...
Andrei Botalov's user avatar
51 votes
16 answers
13k views

Computer login with password only, without username

I have an idea to simplify the login screen on things like home computers with a small number of users (say, 2-10) with passwords. Today, a typical home computer's login screen has three steps: ...
John Zwinck's user avatar
50 votes
7 answers
11k views

Showing "this is secure" on credit card entry screen

Should I show some sort of "this site is secure" puffery (e.g. lock image, or some brief "this site is secure" boilerplate) on my credit card payment screen? If so, what should it look like? If not, ...
Jeffrey Kemp's user avatar
48 votes
10 answers
7k views

Is a "Never tell your password to anyone" message in chat really necessary?

In almost every chat window I open, there's this fairly obvious statement: Never tell your [password/credit card/social security/etc] to anyone. Are there some standards for chat functionality that ...
Gigazelle's user avatar
  • 583
44 votes
6 answers
8k views

Should a user be logged in after resetting their password?

Lets assume following flow: I want to log in I don't remember password I click on the "forgot my password" link (email is dispatched) I check my inbox and click on the link I type in a new password ...
Mars Robertson's user avatar
40 votes
5 answers
6k views

Does a password strength indicator increase password strength?

Just browsing the internet, I saw a password strength indicator on a sign up, and I realized that I personally didn't care. Does anyone know if, on average, password strength indicators increase the ...
OneChillDude's user avatar
39 votes
10 answers
9k views

Is it good idea to send user password upon register?

I can imagine both ways - send / not send and still make it secure enough inside application. For instance: I get the password from "Enter your password" field, store it in email template and then ...
Pavel Janicek's user avatar
33 votes
7 answers
8k views

Why do financial institutions use usernames instead of emails for login?

I'm redesigning an application and I'm researching the use of email vs username login options. Our application works with financial institutions and because of this have been told that usernames are ...
Chromarush's user avatar
  • 1,194
31 votes
2 answers
6k views

How to increase users' perception of security on a payment screen? [duplicate]

Has anyone done any user testing they could share about padlock or shield icons on payments screens and which is perceived as most secure?
Roger's user avatar
  • 333
30 votes
6 answers
3k views

Forcing users to use a particular pattern for passwords

Many websites, specially government ones, enforce users to use a password which conforms to particular criteria. For example: use between 8-13 characters with at-least one integer and one capital ...
Salman Ehsan's user avatar
  • 4,961
27 votes
9 answers
7k views

How to handle "forgot password" when user has not confirmed email?

If you follow the pattern of allowing users access to your application without having confirmed an email (generally considered good UX), how do handle the case where they forgot their password? Very ...
cminu's user avatar
  • 271
21 votes
7 answers
31k views

Should we ask for name on card even though it's not required for credit card payments?

The name on card is not used when processing credit card payments. Paypal does not ask the user to enter the name on card when saving a card to the "wallet", while Amazon.com does. The benefit of ...
F21's user avatar
  • 5,888
18 votes
6 answers
2k views

Should validating an email automatically sign someone into an application?

When signing up for a new account with a web application, it is standard to send a validation email. I don't want to go into the pros and cons of the validation email though. When receiving a ...
JohnGB's user avatar
  • 68.3k
17 votes
5 answers
3k views

Should I use two steps or one when users change password?

I currently have a page dedicated to changing passwords. There are 2 options: A 2 step option: download bmml source – Wireframes created with Balsamiq Mockups download bmml source A 1 step ...
F21's user avatar
  • 5,888
17 votes
2 answers
4k views

Does the padlock icon make users perceive your site as safer?

I was recently in a discussion with one of our developers about the usage of padlock icons (not on the https link) in user interfaces. I remember encountering the icon in lots of different situations;...
Mumas's user avatar
  • 411
17 votes
4 answers
2k views

What good is this moving captcha from Apple

A Hacker News article pointed me to http://www.apple.com/itunes/50-billion-app-countdown/entry-form/ where they use moving captchas: I assume that its a way to make shorter (and therefore convienient)...
Jesvin Jose's user avatar
16 votes
6 answers
28k views

What is the recommended time before a reset password link expires?

I'm working on a financially leaning site and was curious — is there a standard amount of time to wait before expiring a reset password link once a user has forgotten his/hers and requested to reset ...
Rachel Diesel's user avatar
14 votes
4 answers
9k views

Stop user opening links in a new tab

On a secure site, is it OK to stop users from opening a link in a new tab by signing them out? I have a mobile games web-app and my users can only play one at a time. To avoid issues of them trying ...
That-_-Guy__'s user avatar
14 votes
6 answers
11k views

Correct length for login timeout?

My company has created lots of computer software but one issue we have is with login timeouts. Some developers want to make them shorter for security, while most users want it be infinite? Is there ...
Musaab's user avatar
  • 423
13 votes
2 answers
3k views

Why would one limit username format?

Many websites when ask you to create a new "username", will limit you in some way, most often like "username should only contain letters and underscores" or something alike. This results in inability ...
Igor Romanov's user avatar
12 votes
6 answers
4k views

Login button - on homepage or separate page?

I ran across an article called Put the login on the front page, where the author wants sites to: [...]put the user name and password box somewhere obvious on the home page like the upper right ...
John C's user avatar
  • 324
12 votes
4 answers
2k views

Allowing every password of 6+ characters. Good practice?

I am developing a file sharing and hosting service, and right now I don't have any requirements set other then that a password has to be at least 6 characters long. I also accept all characters. I'm ...
Kid Diamond's user avatar
11 votes
5 answers
1k views

Does SSL on a company's website make the company appear more credible?

I recently had a thought about the way many modern browsers display information about a site's security certificates. At least Firefox shows a very noticeable blue box in the address bar on sites that ...
Kaivosukeltaja's user avatar
11 votes
1 answer
1k views

Why does MediaWiki put little padlocks on HTTPS links?

Does anyone know why MediaWiki puts little padlock icons next to HTTPS links? For example, if I put this link in a wiki article: https://twitter.com/harry_wood it would get a little yellow padlock by ...
Harry Wood's user avatar
11 votes
3 answers
1k views

Should I capture exceptions and present a nice error page to hackers? [closed]

If a hacker is trying to hack, should I present a pretty error page or redirect somewhere instead of a generic/cryptic error? I feel that the hacker knows what they are doing, I know what they are ...
Chloe's user avatar
  • 797
11 votes
3 answers
18k views

Reset password, appropriate response if email doesn't exist?

It is common on login forms to see "Email or password is incorrect" when the user types in their account details incorrectly instead of just "password is incorrect". This is, for among other reasons, ...
DasBeasto's user avatar
  • 15.3k
11 votes
4 answers
555 views

When is it right to use "Not <user>?"

Sometimes a site shows a message reading: "You are logged in as [user1]. Not [user1]? Please log out." When is it right to use such a thing? Where are we assuming someone is mistakenly logged in as ...
JNF's user avatar
  • 173
10 votes
3 answers
1k views

Why did they use two-stage social media sharing buttons?

I recently visited a seemingly fairly reputable web site and was astonished to see their implementation of a two-stage trigger for their social media buttons: (The text appears when you hover over ...
msanford's user avatar
  • 5,985
10 votes
3 answers
2k views

Implementing a passphrase instead of a password

I was reading about UX and passwords to try to decide on explaining the requirements (ex: 1 capital letter, 1 number, 1 special character,eight characters) and came across this answer which sent me ...
Fletchling's user avatar
  • 1,213
10 votes
3 answers
1k views

Usability and security for user access and password handling in a web application?

I'm looking at putting together a website aimed at ordinary users that will handle personal data which I don't want to be compromised. How can I make the site secure but also usable? It seems most ...
glenatron's user avatar
  • 203
9 votes
6 answers
5k views

Childproof washing machine

My little boy (11 months old) has just discovered how the buttons and dials of the washing machine work. This is inconvenient, because the machine does not react well to random button mashing while it'...
Sebastian Negraszus's user avatar
9 votes
5 answers
1k views

"Locked" and "secure" icons in one interface

In case of a need to show both "locked" and "secure" icons on one element in an interface (let's say it is one of many tabs in an internet browser, where 'locked' and 'secure' refer to different ...
Dominik Oslizlo's user avatar
9 votes
4 answers
7k views

How many incorrect attempts should be allowed before invalidating a password?

I am trying to prevent brute force attacks on a user's account by invalidating a password when too many attempts are made in the same minute, hour, day or something similar. The credentials in this ...
Alexandre Martins's user avatar
9 votes
3 answers
6k views

Input mask on credit card number & SSN

Our company is discussing the use of an input mask (asterisk) on credit card numbers and social security numbers. I'm completely against masking the CCN, from a UX perspective, especially since our ...
Jerad Rose's user avatar
9 votes
2 answers
248 views

Variable Password Requirements Help

Standford University recently published a quick guide to their password requirements: While I quite like this method and this guide is great, I can't think of a nice way to concisely express this ...
Brad Leach's user avatar
9 votes
4 answers
998 views

Should "Incorrect password" message show the password requirements of the current site? [duplicate]

I have a question that has been bothering me some time, let me illustrate my question with an example: I use multiple passwords in many applications and sometimes I forget what is the password for ...
RdPC's user avatar
  • 191
9 votes
4 answers
251 views

Secure but still usable license key retrieval mechanism?

I just had a very interesting conversation with a support rep of a software product that I love (and which shall remain anonymous here). They use product keys for licensing, and in case the user ...
Jan's user avatar
  • 1,808
9 votes
1 answer
435 views

During sign ups, how to best instill confidence that email addresses will be safe

Many sign up forms will ask you for an email address so that they can contact you. Even the most minimal sign-up (other than no sign up) will need an email address to send you a validation email. ...
Roger Attrill's user avatar
9 votes
5 answers
2k views

Perceived security of magic link/passwordless login

As far as I've read, passwordless login like Slack uses (user inputs their email and then clicks on the login link in their email) is becoming more common and is just as secure as logins that require ...
Briana's user avatar
  • 91
8 votes
5 answers
1k views

Forgotten Passwords - is there a real benefit to asking for memorable password hints on signup?

On several signup forms I see fields such as "Choose your Memorable Password Question". Is this actually benifical nowadays? Surely a more secure method if someone forgets their password is to build a ...
JonW's user avatar
  • 37.2k
8 votes
3 answers
3k views

Login for multiple users

What is the best way to make a login form for multiple users? I'll give you an example for your understanding: If we have three different type of users, for example, teachers, students and ...
leoMestizo's user avatar
8 votes
3 answers
373 views

Should an admin decide what users can do, or should he decide what not to do?

Which one is better option for an admin from a usability point of view? Suppose if a system is supposed to authorize a user to have access (and different type of access like read only or read write) ...
gurvinder372's user avatar
  • 2,185
8 votes
10 answers
903 views

How to best implement "check-in" feature of rewards app

I'm creating a rewards app that relies heavily on a check-in feature. Essentially, if the user checks in it adds to the users "check in count", the more they get the better the rewards such as a ...
DasBeasto's user avatar
  • 15.3k
8 votes
3 answers
736 views

Has Captcha become common knowledge?

I am doing a business site for a web company, and was wondering if Captcha has become so well-known, that it no longer needs an explanation ? Right now there is only a input box, the captcha image ...
Nils Munch's user avatar
8 votes
2 answers
379 views

how can you improve the appearance of security

What are the different ways to make users (especially paranoid one's like me) feel safe about the security aspect of the site?
gurvinder372's user avatar
  • 2,185

1
2 3 4 5