120 votes
Accepted

Should users be allowed to use any special character they want when creating a password?

If the user can type it then it should be allowed in their password. Telling someone what they can and can't use in their password always feels wrong to the user. Passwords are currently the most ...
user avatar
  • 15.8k
39 votes

How to ensure users can't sign up for multiple accounts?

If you are providing a valuable service/product there will always be people trying to "cheat" the system and get in. Providing a free trial period is an industry norm and over time users may sign up ...
user avatar
35 votes

Should users be allowed to use any special character they want when creating a password?

If a site requires that passwords only contain certain character codes, then a user will be able to enter the password into almost any device which is capable of producing those characters. If the ...
user avatar
  • 3,245
31 votes
Accepted

Is a "Login Successful" Message Necessary?

Let me post an answer contrary to existing ones. A "login successful" message is not just unnecessary but it's also wrong. Why Unnecessary Think if objects/devices you use in everyday life will give ...
user avatar
20 votes

Should users be allowed to use any special character they want when creating a password?

I would like to add to DaveAlger's point. I, like many people, create algorithms in order to better remember passwords. I've spoken to many people (in an informal manner) about passwords and I have ...
user avatar
  • 6,611
15 votes
Accepted

How to ensure users can't sign up for multiple accounts?

This is a tough issue that I'm not sure anyone has really solved yet, but here are my thoughts for your 3 solutions. Phone number Yes this might be a bit personal or creepy but I feel like it's ...
user avatar
  • 779
13 votes

How to ensure users can't sign up for multiple accounts?

Consider using federated user authentication from some social network like Facebook or Twitter. You can suggest to your user that your use of social credentials is a service to them, saving them the ...
user avatar
  • 1,011
10 votes
Accepted

What is the proper way to change user email?

Changing email is not allowed by some of the web applications due to security reasons. Some of the apps which allow this uses the following workflow: You present the editable section where the user ...
user avatar
  • 694
9 votes

How to ensure users can't sign up for multiple accounts?

Honestly, a valuable product. You are not the first one to offer trials. You would scare more potential customers off than you would save through fraud-detection processes. If your customers like ...
user avatar
  • 1,463
9 votes

How to ensure users can't sign up for multiple accounts?

Right now, you should not be solving this problem. Not only is it a problem you do not have, but solving it too early may mean you will never have the problem. Lemme splain. Lemme sum up. The more ...
user avatar
  • 219
8 votes

Is a "Login Successful" Message Necessary?

More than necessary, I think the word is convenient or recommendable. and of course, the message or its phrasing doesn't need to be the one you mention, as long as there's a clear indication of a ...
user avatar
  • 32.5k
7 votes

How to ensure users can't sign up for multiple accounts?

I think that there's no real solution to your problem. That might be hard to hear, but there's no way to gain any security without sacrificing your user experience. Instead, we just need to pick the "...
user avatar
7 votes
Accepted

How many incorrect attempts should be allowed before invalidating a password?

This question has been asked multiple times throughout the StackExchange network over the years. Here's a summary of answers: There's no clear research on the subject. If you're in the financial ...
user avatar
  • 13.2k
6 votes

What is the correct tab-indexing for a log-in form with a "forgot password" link?

In my experience, many keyboard users expect the following tab order for a typical login form: 1. Username field 2. Password field 3. Submit button They’ll often blindly enter the username press ...
user avatar
  • 3,906
6 votes

Is there any advantage of signup before login with social plugins?

We used social plugin for couple of our products for login. To answer your first question, the simple advantage is that the user need not enter his credentials every time he/she signs in to your app. ...
user avatar
  • 61
6 votes

What is the best mobile number authorization strategy?

Both are equally good in terms of security. According to me the first senerio is good enough and adapted one. We are used to first senerio. The second senerio doesn't making much changes and ...
user avatar
6 votes
Accepted

Verifying an account with SMS as opposed to email address

A lot of people use their phone to sign up for services. Having to go to your messages to copy the code and then drop it into the interface can be slower than just going into your email client and ...
user avatar
5 votes
Accepted

Facebook/Twitter login only vs. Facebook/Twitter signup and login separately

Why not simply use 'Connect with Facebook' 'Connect with Twitter' on this screen - What is the advantage of differentiating between signup vs signin here? From the users perspective the action is the ...
user avatar
  • 151
5 votes
Accepted

Is there any advantage of signup before login with social plugins?

However it might be done, logging in and signing up are two different things. The sign up path is almost certainly more complex than the login path, regardless of whether social login or a more ...
user avatar
  • 7,818
5 votes
Accepted

2FA into the login page (without email or phone number)

Reasons I could think of why 2FA is on a separate page: Sense of security If you are using 2FA, you want your account to be more secure at the expense of ease of use. I would guess that users will ...
user avatar
  • 2,373
4 votes

How to ensure users can't sign up for multiple accounts?

We use phone verification that limits duplicate accounts. We ask them to text the number they see on the screen. Note, we don't ask them right away but we do limit pro features that require ...
user avatar
4 votes
Accepted

Should I verify e-mail format in login form?

Purely out of usability reasons you should always tell user what's wrong with the input. If the user doesn't know what's going wrong, he has to guess. Guessing on it's own is a a bad user experience ...
user avatar
  • 1,266
4 votes
Accepted

Should web sites have their own authentication?

Depends what your site is for. If the site is for something specific that you might not want shared (or known) socially then you may find Facebook/Google/Twitter logins might not cut it. There's also ...
user avatar
  • 3,702
4 votes

Verifying an account with SMS as opposed to email address

It's best to offer both email and SMS sign-up -- some users prefer the control that an email address provides, such as in cases of householding (when a couple or family signs up for an account, and ...
user avatar
  • 8,779
4 votes

Automatical Button-Less Login

What problem are you trying to solve? While the form you are proposing is certainly technically possible, it is not clear how it improves the overall user experience of logging in. Login forms do ...
user avatar
  • 8,848
4 votes

At what step in the user flow of a travel booking app would 2FA OTP be needed

I would use 2FA on login if the user has enabled it. 2FA can be annoying for users so get it out of the way up front at login where a user would expect it to be and keep the user logged in. You can ...
user avatar
  • 1,537
3 votes

Should users be allowed to use any special character they want when creating a password?

It can make sense from a usability and support perspective. If the character isn't possible to type on a keyboard/phone without using alt codes or copy-pasting. Keep in mind that the most active ...
user avatar
3 votes

Should users be allowed to use any special character they want when creating a password?

It depends. If you've got reasonably strong control over the password input mechanism (keyboard layouts, software stacks, etc.), then letting users freely input anything they want is a good idea, ...
user avatar
  • 1,877
3 votes

Should users be allowed to use any special character they want when creating a password?

One problem that I've seen with non-ASCII passwords is that some systems deal with characters and others deal with encoding-specific code points. The "א" character might be represented in different ...
user avatar
  • 1,079
3 votes
Accepted

In Single Sign On what does SAML "enabled" control do or mean?

As you already know what SAML is, I'm not going to go into specifics of that and simply consider it a system for federated sign-ups / log-ins. What you've shows seems to be a simple option as to ...
user avatar
  • 67.5k

Only top scored, non community-wiki answers of a minimum length are eligible