First, I thought they try to prevent attackers from randomly guessing email addresses and checking whether they are registered or not. Imagine you know that Donald.Trump@yahoo.com is registered to, e.g., craigslist. This might be a great privacy issue in some cases.
This is precisely the reason why so many websites have implemented it that way and that's ...
Ignoring the issue of lying to your customers, whether blatantly or through omission, you could simply say something like
Due to recent changes, on our server we require all passwords to be
updated. Sorry for any inconvenience.
My personal choice, however, would be to be as honest as you can (though, without losing user confidence)
We have recently ...
You don't want anyone knowing even that someone has an account.
If a malicious actor is searching for info on someone, it could be potentially damaging just knowing that someone even has an account / is a member of an organization.
Each piece of info is a betrayal of a users right to privacy.
To go further, let's say you have an organization or app that a ...
The problem with Security Questions
While it may seem that security questions are something that you'd want to implement in your application to provide an additional layer of security, you aren't really adding anything of value to the security of your user's accounts. A study by Google showed that across their very large user base, security questions were ...
I have wrote a couple articles on this subject (in Spanish). The obvious answer would be: use multi-factor authentication. I really despise that approach. In those articles I have demonstrated with real user cases that they're not necessarily more secure, but they always lead to HORRIBLE user experiences.
Without getting into great detail, let me put it as ...
The difference is in the style of your product.
If you introduced popups in your product, you can go with popups, if not then try to avoid popups.
Advantages are in the favor of style.
Disadvantages: If you are using third-party add-ons as a handler for modals/pop-ups, this can cause you bad UX in terms of loading these modals/pop-ups.
EDIT: If your ...
While they do the same thing, I do not believe it is correct to merge the process. The reason you need to enter your current password is so that third party users of the account can not take over the account.
For instance, I keep Facebook logged in on my PC. If my friends visit my place my computer is usually on standby. If you do not need to enter ...
If the duration is a year, nobody is going to track this for their own records and then keep you accountable if they are still logged in 1 year + 1 day from the initial login date. If you're set for 14 days or more, it might as well just say "Keep me signed in." save the characters, have less clutter.
However, a clarification on shorter time-spans such as "(...
Nobody cares about the "type" of security you're using. Users only care how it impacts them.
In your case, the impact is as simple as resetting a password. And you're not lying by saying you're making it better (assuming it was reasonably secure before).
So, I agree that some messaging along the lines of:
We've recently updated our security systems and ...
First of all if you want to be save in the future provide your users the possibility to enter additional information that could restore their account in such a case, like:
• Mobile number
• Second E-mail
This way you gave your users the chance to prevent this situation, even if many will not use it, they will have a hard time to blame you.
Regarding your ...
Hmm, the "reset password" screen should be a temporary, tokenized screen, divorced from any logged-in view.
In other words, even if they're logged in on the device they open the "reset password" screen on, the screen they see should have nothing to do with that logged-in account. It doesn't need to log them out, necessarily (that's up to your dev team to ...
TL;DR - No, it's not a bad idea to allow the user to click on the forgot password link and it isn't a good idea to directly send out an email
Should the user be allowed to click on the "Forgot Password?" link without typing in their login id or before a failed attempt at logging in?
Yes! Of course! Refer to my answer here for the scenario. In ...
You got the rationale right. This is a protection from letting someone check whether someone is registered at a service.
You also got right that, if you try to create an account, it will give you an error if it is already registered. HOWEVER:
When you are trying to find an account to hack, you want to only check. You don't want to create an account. So ...
Send OTP on registered mobile number or recovery email id that was used at the time of sign up process. You can ask the user to select one of the options from the above.
I agree with Devin points
If you use recovery questions, make them really easy to remember. I really have to make an effort to remember my first school name, or my
first pet's name (...