10
votes
Accepted
What is the proper way to change user email?
Changing email is not allowed by some of the web applications due to security reasons. Some of the apps which allow this uses the following workflow:
You present the editable section where the user ...
- 684
6
votes
What is the best mobile number authorization strategy?
Both are equally good in terms of security.
According to me the first senerio is good enough and adapted one.
We are used to first senerio.
The second senerio doesn't making much changes and ...
- 1,428
6
votes
Accepted
Verifying an account with SMS as opposed to email address
A lot of people use their phone to sign up for services. Having to go to your messages to copy the code and then drop it into the interface can be slower than just going into your email client and ...
- 9,851
5
votes
Accepted
2FA into the login page (without email or phone number)
Reasons I could think of why 2FA is on a separate page:
Sense of security
If you are using 2FA, you want your account to be more secure at the expense of ease of use. I would guess that users will ...
- 2,443
4
votes
Accepted
Should web sites have their own authentication?
Depends what your site is for. If the site is for something specific that you might not want shared (or known) socially then you may find Facebook/Google/Twitter logins might not cut it.
There's also ...
- 3,702
4
votes
Verifying an account with SMS as opposed to email address
It's best to offer both email and SMS sign-up -- some users prefer the control that an email address provides, such as in cases of householding (when a couple or family signs up for an account, and ...
- 12k
4
votes
Automatical Button-Less Login
What problem are you trying to solve?
While the form you are proposing is certainly technically possible, it is not clear how it improves the overall user experience of logging in.
Login forms do ...
- 8,888
4
votes
At what step in the user flow of a travel booking app would 2FA OTP be needed
I would use 2FA on login if the user has enabled it. 2FA can be annoying for users so get it out of the way up front at login where a user would expect it to be and keep the user logged in. You can ...
- 1,557
3
votes
Accepted
How to explain the concept of choosing password to user
Follow these 2 steps
1) When user logs in first with your auto-generated password, ask them to create your own password with which they will login next time.
2) When user make a purchase or ...
- 2,185
3
votes
Authenticating / Validating a user, from an email/SMS invite
A suggestion for making the system more secure. A provider of some of my student loans secures users by showing them a random person's face during registration with the directions to remember the face....
3
votes
Accepted
Good UX practices for 2 factor authentication 2FA
There are four main types of 2FA in common use by consumer websites:
SMS 2FA
When you enable a site's SMS 2FA option, you'll often be asked to provide a phone number. Next time you log in with your ...
- 2,349
3
votes
Accepted
How to clearly distinguish a login page from a register page?
I don't see anything wrong with those two pages. They are everything you expect them to be.
You have the titles "Sign in to your account" and "Register your account", you have the buttons clearly ...
- 556
3
votes
Smartphone-only apps: consequences of limiting one account per phone number?
Well, one of the consequences is that you'll lose users who are not willing to share their phone number with you. I think I've shared my phone number and contacts list with only one app (WhatsApp); ...
- 3,310
3
votes
User signs up using their Facebook account logs and then logs in with their (same email) Google account. Now what?
I think the best solution would be that every account is associated to the email. Once they log in with one social then it's linked.
So let's say I have google and facebook, I connect google and then ...
- 31
3
votes
Accepted
iOS apps log users out when upgrading to a new phone
How do I know it was the real user that upgraded the phone and not some one who shouldn't? That is the security and safety risk that exists in auto migration for accounts between devices. Hence, when ...
- 459
2
votes
Should my app send a confirmation email on user registration?
I will attempt to offer something different than the other answers.
When you're onboarding your users for the first time, in order to retain them better you have to keep them in the app and show them ...
- 7,371
2
votes
Should my app send a confirmation email on user registration?
I recommend considering social verification instead of email, because that's the way modern mobile operating systems are built.
iOS (and Android, though I'm less familiar with the Android OS) has ...
- 608
2
votes
Should my app send a confirmation email on user registration?
Unless you're really, really concerned about the authenticity of users' email addresses - skip the 2nd step.
If, for some reason, you want users to sign up with their real identities - again skip ...
- 117
2
votes
Correct UX for the scenario when a user forgets the answers to their security questions?
The correct UX approach is to disregard the long overdue pattern of so called “security questions”. Users tend to forget them as well, especially in terms of capitalization of answers.
Instead you ...
- 54.9k
2
votes
Correct UX for the scenario when a user forgets the answers to their security questions?
What is the correct UX for the scenario when a user forgets the answers to their security questions?
For your authentication mechanism (which, unless it's required by law, I see as paranoid) security ...
- 5,053
2
votes
Best practice for two-factor authentication process
At first glance, it does seem counter-productive to allow a "remember this device" feature for two-factor authentication, however I can see why it would be useful, with relatively little ...
- 228
2
votes
is replying to an sms a reliable way of authenticating a response
You should never rely on SMS.
Delivery is not guaranteed, and you have no way to determine whether or not it took place. Additionally, SMS is not encrypted, and from a security standpoint, it is not ...
- 687
2
votes
Best format and maximum length for manually typed authentication code
Generally, chunks of 3 to 4 numbers is optimal. See phone numbers and credit cards. You could do 2x4 digit chunks, 3x3 digit chunks, etc.
- 21
2
votes
What percent of Android users with fingerprint enabled phones use the fingerprint feature?
I find this very interesting, since your number are in correlation with those mentionned in those studies (by Gigya and Paypal, so it's quite relevant) :
http://www.gigya.com/survey-reveals-52-...
- 860
2
votes
Accepted
different pricing for new customers VS. existing customers
This is a very interesting problem. How I would tackle this issue in our e-commerce sites is:
When the user is not logged in => Show the prices for new users/universal price, but name it somehow ...
- 3,719
2
votes
Accepted
When using embedded browser authentication, how can I increase user trust?
One tactic is to do it Apple's way. Tell them. If they are wondering, it has a friendly way of telling, but it's out of the way when not needed.
Example Popup
This login box uses OAuth 2, the most ...
- 114
2
votes
What is the best mobile number authorization strategy?
I have to be honest and say I have never liked the idea of verifying mobile phones as a security measure. More places are starting to use this as their sole verification method, which causes major ...
- 3,826
2
votes
What are the pro's and con's of an extended user session?
I think it depends mostly on the nature of the system.
The pros of being auto logged out
Paradoxically, in some cases being logged out automatically may improve the general satisfaction of the User ...
- 13.9k
2
votes
Two factor authentication in a single form
This is a good opportunity to a/b test the options you’re considering!
I’ve used single form, two-factor authentication logins. Here’s what I’ve observed as an end-user of those systems.
If the user ...
- 650
2
votes
How to prevent creation of multiple accounts under the same company?
Others have mentioned that there is no technical way to enforce this restriction 100%. People can be clever, people will find ways around this.
One approach would be to legally enforce this, by ...
- 1,987
Only top scored, non community-wiki answers of a minimum length are eligible