Skip to main content
10 votes
Accepted

What is the proper way to change user email?

Changing email is not allowed by some of the web applications due to security reasons. Some of the apps which allow this uses the following workflow: You present the editable section where the user ...
K K's user avatar
  • 694
6 votes

What is the best mobile number authorization strategy?

Both are equally good in terms of security. According to me the first senerio is good enough and adapted one. We are used to first senerio. The second senerio doesn't making much changes and ...
Abhishek Sharma's user avatar
6 votes
Accepted

Verifying an account with SMS as opposed to email address

A lot of people use their phone to sign up for services. Having to go to your messages to copy the code and then drop it into the interface can be slower than just going into your email client and ...
Wendy Wojenka's user avatar
5 votes
Accepted

2FA into the login page (without email or phone number)

Reasons I could think of why 2FA is on a separate page: Sense of security If you are using 2FA, you want your account to be more secure at the expense of ease of use. I would guess that users will ...
Nash's user avatar
  • 2,451
4 votes

Verifying an account with SMS as opposed to email address

It's best to offer both email and SMS sign-up -- some users prefer the control that an email address provides, such as in cases of householding (when a couple or family signs up for an account, and ...
Izquierdo's user avatar
  • 12.7k
4 votes

Automatical Button-Less Login

What problem are you trying to solve? While the form you are proposing is certainly technically possible, it is not clear how it improves the overall user experience of logging in. Login forms do ...
Nathan Rabe's user avatar
  • 8,878
4 votes

At what step in the user flow of a travel booking app would 2FA OTP be needed

I would use 2FA on login if the user has enabled it. 2FA can be annoying for users so get it out of the way up front at login where a user would expect it to be and keep the user logged in. You can ...
James Coyle's user avatar
  • 1,577
3 votes

Authenticating / Validating a user, from an email/SMS invite

A suggestion for making the system more secure. A provider of some of my student loans secures users by showing them a random person's face during registration with the directions to remember the face....
Melissa Easker's user avatar
3 votes
Accepted

Good UX practices for 2 factor authentication 2FA

There are four main types of 2FA in common use by consumer websites: SMS 2FA When you enable a site's SMS 2FA option, you'll often be asked to provide a phone number. Next time you log in with your ...
Kish's user avatar
  • 2,607
3 votes
Accepted

How to clearly distinguish a login page from a register page?

I don't see anything wrong with those two pages. They are everything you expect them to be. You have the titles "Sign in to your account" and "Register your account", you have the buttons clearly ...
Alin's user avatar
  • 556
3 votes

Smartphone-only apps: consequences of limiting one account per phone number?

Well, one of the consequences is that you'll lose users who are not willing to share their phone number with you. I think I've shared my phone number and contacts list with only one app (WhatsApp); ...
Glorfindel's user avatar
  • 3,320
3 votes

User signs up using their Facebook account logs and then logs in with their (same email) Google account. Now what?

I think the best solution would be that every account is associated to the email. Once they log in with one social then it's linked. So let's say I have google and facebook, I connect google and then ...
Olo's user avatar
  • 31
3 votes
Accepted

iOS apps log users out when upgrading to a new phone

How do I know it was the real user that upgraded the phone and not some one who shouldn't? That is the security and safety risk that exists in auto migration for accounts between devices. Hence, when ...
Chris Griffith's user avatar
2 votes

Best practice for two-factor authentication process

At first glance, it does seem counter-productive to allow a "remember this device" feature for two-factor authentication, however I can see why it would be useful, with relatively little ...
crazyloonybin's user avatar
2 votes

Should my app send a confirmation email on user registration?

I will attempt to offer something different than the other answers. When you're onboarding your users for the first time, in order to retain them better you have to keep them in the app and show them ...
RobbyReindeer's user avatar
2 votes

Should my app send a confirmation email on user registration?

I recommend considering social verification instead of email, because that's the way modern mobile operating systems are built. iOS (and Android, though I'm less familiar with the Android OS) has ...
Refe's user avatar
  • 608
2 votes

is replying to an sms a reliable way of authenticating a response

You should never rely on SMS. Delivery is not guaranteed, and you have no way to determine whether or not it took place. Additionally, SMS is not encrypted, and from a security standpoint, it is not ...
jsejcksn's user avatar
  • 687
2 votes

Best format and maximum length for manually typed authentication code

Generally, chunks of 3 to 4 numbers is optimal. See phone numbers and credit cards. You could do 2x4 digit chunks, 3x3 digit chunks, etc.
drfino's user avatar
  • 21
2 votes

What percent of Android users with fingerprint enabled phones use the fingerprint feature?

I find this very interesting, since your number are in correlation with those mentionned in those studies (by Gigya and Paypal, so it's quite relevant) : http://www.gigya.com/survey-reveals-52-...
ArkDeus's user avatar
  • 870
2 votes
Accepted

different pricing for new customers VS. existing customers

This is a very interesting problem. How I would tackle this issue in our e-commerce sites is: When the user is not logged in => Show the prices for new users/universal price, but name it somehow ...
Dimitra Miha's user avatar
  • 3,739
2 votes
Accepted

When using embedded browser authentication, how can I increase user trust?

One tactic is to do it Apple's way. Tell them. If they are wondering, it has a friendly way of telling, but it's out of the way when not needed. Example Popup This login box uses OAuth 2, the most ...
Elijah Ciali's user avatar
2 votes

Two factor authentication in a single form

This is a good opportunity to a/b test the options you’re considering! I’ve used single form, two-factor authentication logins. Here’s what I’ve observed as an end-user of those systems. If the user ...
Michael Hogan's user avatar
2 votes

What are the pro's and con's of an extended user session?

I think it depends mostly on the nature of the system. The pros of being auto logged out Paradoxically, in some cases being logged out automatically may improve the general satisfaction of the User ...
Dominik Oslizlo's user avatar
2 votes

How to prevent creation of multiple accounts under the same company?

Others have mentioned that there is no technical way to enforce this restriction 100%. People can be clever, people will find ways around this. One approach would be to legally enforce this, by ...
uliwitness's user avatar
  • 1,977
2 votes

What is the best mobile number authorization strategy?

I have to be honest and say I have never liked the idea of verifying mobile phones as a security measure. More places are starting to use this as their sole verification method, which causes major ...
Monomeeth's user avatar
  • 3,826
2 votes

What is the terminology for the page to which the user is redirected to, after successful login?

As you said, dashboard is the wrong term if the page the user gets redirected to is not offering dashboard-like data. I would call this page the front page, home page is not wrong either but its kind ...
Pectoralis Major's user avatar
2 votes

What is the terminology for the page to which the user is redirected to, after successful login?

The page should be described by what it does, not by consensus. Therefore, if the page that users are taken to, after a successful log-in is a dashboard, call it a dashboard. Trying to bless it with ...
DarrylGodden's user avatar
  • 6,336
2 votes

Verifying an account with SMS as opposed to email address

I would share my experience with lots of banking, wallet, Social apps which are actually asking for verification via an SMS. Even Apple is sending a verification SMS to its servers before activating ...
Shabir Gilkar's user avatar
2 votes

How to clearly distinguish a login page from a register page?

Please use "Log in" instead of "Sign in" if you are using "Sign up" word. If you see top brands, they follow this simple rule to avoid confusion with similar looking words. If you use some other words ...
UXPAPA's user avatar
  • 106
2 votes

Layman's term and description for 2-Step Verification process

You could describe it as a door with two locks. They have to unlock the larger deadbolt (password) and the door-handle lock (text message code) to get into the account. The locked door analogy would ...
Mike W's user avatar
  • 356

Only top scored, non community-wiki answers of a minimum length are eligible