Skip to main content
Share Your Experience: Take the 2024 Developer Survey
9 votes

Changing password - 'Old password' vs 'Current password'

A two-step approach to changing passwords eliminates the need to use either term (see below). However, if you're going to use a single-form approach, I'd recommend "current" as it's more accurate. ...
Jonathan's user avatar
  • 2,519
9 votes

Users aren't allowed to reuse old passwords for security reasons. How to alleviate this pain point?

Switch to two-factor authentication and reduce the frequency of forced password changes. BTW, your system storing their last 12 passwords, even encrypted, is a major security problem. A hacker who ...
Izquierdo's user avatar
  • 12.7k
8 votes
Accepted

How to prompt existing customers to change their passwords

Ignoring the issue of lying to your customers, whether blatantly or through omission, you could simply say something like Due to recent changes, on our server we require all passwords to be ...
DrogoNevets's user avatar
7 votes

Users aren't allowed to reuse old passwords for security reasons. How to alleviate this pain point?

The NIST has a policy for passwords that can be helpful to answer your question. First you should talk again to your security team. The NIST has deleted their policy to force users change their ...
Torben's user avatar
  • 71
4 votes

Users aren't allowed to reuse old passwords for security reasons. How to alleviate this pain point?

Some options to consider: Two-factor authentication. I'm not a fan, but it might be better than what you have if it would reduce the frequency of password changes. It doesn't make much sense to ...
習約塔's user avatar
  • 1,885
4 votes

Is it lazy or inconvenient not to distinguish between password reset use cases in the UI?

Depending on which application or company asked you for a password reset it is usually a matter of convenience. When it comes to designing these kinds of flows, usually little priority is given, as it ...
kn03i's user avatar
  • 326
3 votes
Accepted

Why don't Wifi router UI's use confirmation password boxes?

Mistyping an intended wifi password is quick and easy to fix. As soon as you set the password, your next step is to join the network with the password. You essentially know right away if there was a ...
Izquierdo's user avatar
  • 12.7k
3 votes

Changing password: Verify with old password, verify by email, or don't verify?

So, something I didn't see mentioned in the answer above (excellent as it may be) is the actual security purpose of the methods requiring additional user input. Consider the case of a web app that ...
drognisep's user avatar
  • 141
3 votes

Changing password: Verify with old password, verify by email, or don't verify?

There is an intrinsic conflict in this question. UX attempts to remove hurdles from the user; to make things easier. Security exists to prevent unauthorized access to information and it must deal ...
Mayo's user avatar
  • 6,641
2 votes

Are there examples of reminders for recent password changes?

As Andy stated, Google do it quite well, as do Facebook. So it seems like a viable option, and from a UX point of view, it's quite handy giving people a visual clue what the error is and how to ...
DarrylGodden's user avatar
  • 6,336
2 votes

How to prompt existing customers to change their passwords

Nobody cares about the "type" of security you're using. Users only care how it impacts them. In your case, the impact is as simple as resetting a password. And you're not lying by saying you're making ...
Bryce Howitson's user avatar
2 votes

Merging change password and forgotten password process?

While they do the same thing, I do not believe it is correct to merge the process. The reason you need to enter your current password is so that third party users of the account can not take over the ...
Kevin M.'s user avatar
  • 1,074
1 vote

How to properly represent "leave unchanged"

Simply place helper text around input field "leave blank to remain unchanged". It is better to define separate user journey for update password functionality for simplicity. Even with the security ...
Codesigner's user avatar
1 vote

Should I keep my change password section within the change profile section or settings?

I'm not sure I understand where all the current items under Settings would live if you remove the parent element but in any case, context wise I think password management belongs to an account or ...
legnaleama's user avatar
1 vote

Is it lazy or inconvenient not to distinguish between password reset use cases in the UI?

Answers to your questions, IMO are; You cannot know if this is a common practice, as it probably depends upon company The same goes for the reason it is done that way It could be bad UX. Not sure ...
xul's user avatar
  • 2,676
1 vote

Is it lazy or inconvenient not to distinguish between password reset use cases in the UI?

It sounds like what most likely happened is they did not want to do extra development to set up in place a different flow. Now I consider there were two options, one to create a different flow and ...
Chris's user avatar
  • 4,558
1 vote

Users aren't allowed to reuse old passwords for security reasons. How to alleviate this pain point?

What you are talking about is a big headache, so, for this reason, your startup needs to think smarter. Actually, I've been doing research on how this process can be done fast and intuitive. I have ...
Khalil Hanna's user avatar
  • 1,264
1 vote

Should you allow a change in password in a registration form?

My suggestion is to, Get the name, email, phone number and create the account. Request for the user to enter the verification code. (To confirm that is valid mail or mobile number) Get the password ...
Praveen's user avatar
  • 135
1 vote

How to tell the user what their options are when they forget their password and there is not the option to reset it through the web or email?

A "Forgot Password?" Link is usually the cleanest way to provide a set of options to the user. When the user clicks the link you can then show a screen with full details on all the options.
scunliffe's user avatar
  • 3,712
1 vote

Are there examples of reminders for recent password changes?

Can't say that I have ever come across any system/software/app that reminds user of recent updation of password. Never really thought that could or should be a feature. But now that you bring it up, ...
Shreyas Tripathy's user avatar

Only top scored, non community-wiki answers of a minimum length are eligible