10
votes
Accepted
What is the proper way to change user email?
Changing email is not allowed by some of the web applications due to security reasons. Some of the apps which allow this uses the following workflow:
You present the editable section where the user ...
- 694
6
votes
Accepted
Verifying an account with SMS as opposed to email address
A lot of people use their phone to sign up for services. Having to go to your messages to copy the code and then drop it into the interface can be slower than just going into your email client and ...
- 9,921
5
votes
Accepted
2FA into the login page (without email or phone number)
Reasons I could think of why 2FA is on a separate page:
Sense of security
If you are using 2FA, you want your account to be more secure at the expense of ease of use. I would guess that users will ...
- 2,481
4
votes
Verifying an account with SMS as opposed to email address
It's best to offer both email and SMS sign-up -- some users prefer the control that an email address provides, such as in cases of householding (when a couple or family signs up for an account, and ...
- 12.9k
4
votes
Automatical Button-Less Login
What problem are you trying to solve?
While the form you are proposing is certainly technically possible, it is not clear how it improves the overall user experience of logging in.
Login forms do ...
- 8,878
4
votes
At what step in the user flow of a travel booking app would 2FA OTP be needed
I would use 2FA on login if the user has enabled it. 2FA can be annoying for users so get it out of the way up front at login where a user would expect it to be and keep the user logged in. You can ...
- 1,587
3
votes
Accepted
Good UX practices for 2 factor authentication 2FA
There are four main types of 2FA in common use by consumer websites:
SMS 2FA
When you enable a site's SMS 2FA option, you'll often be asked to provide a phone number. Next time you log in with your ...
- 3,017
3
votes
Authenticating / Validating a user, from an email/SMS invite
A suggestion for making the system more secure. A provider of some of my student loans secures users by showing them a random person's face during registration with the directions to remember the face....
3
votes
Accepted
How to clearly distinguish a login page from a register page?
I don't see anything wrong with those two pages. They are everything you expect them to be.
You have the titles "Sign in to your account" and "Register your account", you have the buttons clearly ...
- 556
3
votes
Smartphone-only apps: consequences of limiting one account per phone number?
Well, one of the consequences is that you'll lose users who are not willing to share their phone number with you. I think I've shared my phone number and contacts list with only one app (WhatsApp); ...
- 3,330
3
votes
User signs up using their Facebook account logs and then logs in with their (same email) Google account. Now what?
I think the best solution would be that every account is associated to the email. Once they log in with one social then it's linked.
So let's say I have google and facebook, I connect google and then ...
- 31
3
votes
Accepted
iOS apps log users out when upgrading to a new phone
How do I know it was the real user that upgraded the phone and not some one who shouldn't? That is the security and safety risk that exists in auto migration for accounts between devices. Hence, when ...
- 479
2
votes
is replying to an sms a reliable way of authenticating a response
You should never rely on SMS.
Delivery is not guaranteed, and you have no way to determine whether or not it took place. Additionally, SMS is not encrypted, and from a security standpoint, it is not ...
- 686
2
votes
Best practice for two-factor authentication process
At first glance, it does seem counter-productive to allow a "remember this device" feature for two-factor authentication, however I can see why it would be useful, with relatively little ...
- 228
2
votes
Should my app send a confirmation email on user registration?
I will attempt to offer something different than the other answers.
When you're onboarding your users for the first time, in order to retain them better you have to keep them in the app and show them ...
- 7,423
2
votes
Should my app send a confirmation email on user registration?
I recommend considering social verification instead of email, because that's the way modern mobile operating systems are built.
iOS (and Android, though I'm less familiar with the Android OS) has ...
- 618
2
votes
Best format and maximum length for manually typed authentication code
Generally, chunks of 3 to 4 numbers is optimal. See phone numbers and credit cards. You could do 2x4 digit chunks, 3x3 digit chunks, etc.
- 21
2
votes
Accepted
different pricing for new customers VS. existing customers
This is a very interesting problem. How I would tackle this issue in our e-commerce sites is:
When the user is not logged in => Show the prices for new users/universal price, but name it somehow ...
- 3,759
2
votes
Accepted
When using embedded browser authentication, how can I increase user trust?
One tactic is to do it Apple's way. Tell them. If they are wondering, it has a friendly way of telling, but it's out of the way when not needed.
Example Popup
This login box uses OAuth 2, the most ...
- 114
2
votes
What are the pro's and con's of an extended user session?
I think it depends mostly on the nature of the system.
The pros of being auto logged out
Paradoxically, in some cases being logged out automatically may improve the general satisfaction of the User ...
- 13.9k
2
votes
Two factor authentication in a single form
This is a good opportunity to a/b test the options you’re considering!
I’ve used single form, two-factor authentication logins. Here’s what I’ve observed as an end-user of those systems.
If the user ...
- 650
2
votes
What is the terminology for the page to which the user is redirected to, after successful login?
The page should be described by what it does, not by consensus.
Therefore, if the page that users are taken to, after a successful log-in is a dashboard, call it a dashboard.
Trying to bless it with ...
- 6,324
2
votes
What is the terminology for the page to which the user is redirected to, after successful login?
As you said, dashboard is the wrong term if the page the user gets redirected to is not offering dashboard-like data.
I would call this page the front page, home page is not wrong either but its kind ...
- 10.8k
2
votes
Verifying an account with SMS as opposed to email address
I would share my experience with lots of banking, wallet, Social apps which are actually asking for verification via an SMS. Even Apple is sending a verification SMS to its servers before activating ...
- 308
2
votes
How to prevent creation of multiple accounts under the same company?
Others have mentioned that there is no technical way to enforce this restriction 100%. People can be clever, people will find ways around this.
One approach would be to legally enforce this, by ...
- 1,977
2
votes
How to clearly distinguish a login page from a register page?
Please use "Log in" instead of "Sign in" if you are using "Sign up" word. If you see top brands, they follow this simple rule to avoid confusion with similar looking words. If you use some other words ...
- 106
2
votes
Layman's term and description for 2-Step Verification process
You could describe it as a door with two locks. They have to unlock the larger deadbolt (password) and the door-handle lock (text message code) to get into the account. The locked door analogy would ...
- 356
2
votes
What are the advantages of selfies for security?
Potential disadvantages are numerous:
Application should have the access to phone camera (or it cannot work)
People are not always OK with sending their pictures
Users need to have necessary ...
- 678
2
votes
Accepted
Button appears in two important locations and feels redundant
Option 1: Keep only Login in the4 navbar
A common pattern that is used across the board is the use of only the Login CTA in the nav bar. Once in the login screen, the user is given the option to Sign ...
- 6,819
2
votes
How to get around wanting to use email as unique login, but having existing users with multiple accounts per email?
Very interesting problem.
Combine accounts
Combine the accounts but have multiple users within an account. Something like Netflix where you can choose your user after logging in. Force users to ...
- 2,378
Only top scored, non community-wiki answers of a minimum length are eligible