New answers tagged

1

I would use 2FA on login if the user has enabled it. 2FA can be annoying for users so get it out of the way up front at login where a user would expect it to be and keep the user logged in. You can always ask for 2FA authentication again if the user hasn't provided it in a while and they need to do something which requires extra security. Remember that you ...


1

"As users are able to store personal information including their payment details, this level of verification is needed." Actually, it should only be needed if/when something strange/unusual/out-of-the-ordinary happens regarding the account that has authenticated with a single factor. I.e. 2FA OTP is an annoying step, it is slow and prone to problems (like ...


0

I think "landing page" is the right page, that is if you redirect people that specifically logged in by going to the login page to this page, i.e (it's the default page for people who didn't get to your website by clicking a direct link to a secured page). NB: People that got on the login page by trying to access a secure page should be redirected to the ...


0

In my company, the site without logging in, is a big multi-page retail environment the user can use to find all kind of information about the services the compan offers. We call that the retail space or retail environment. The environment after login, is seen by the client as 'My Environment' (so their environment technically). It's where the client use our ...


0

Possible affordances id - basic condition (if id boughts - not access) - it's possible to create new account ip address (if ip address bought - not access) - it's possible to change ip/have a changing network VISA - (if VISA boughts - not access) - it's possible to create new card Cookies Telephone Number (Pin system(?)) If you connect those 3 conditions -...


Top 50 recent answers are included