104 votes

Should passwords expire?

A compromise is that when a user returns to the site after 6 months (or whatever period) then you might helpfully recommend that they think about changing their password - along with a link to why ...
user avatar
95 votes
Accepted

Is it good idea to send user password upon register?

No - It is a bad idea: a. Storing password as plain text instead of hashed with an individual salt. More details here and here. b. Emailing a password, as: b.1. emails are transmitted unencrypted ...
user avatar
  • 7,283
72 votes

"Typocaptcha" - an alternative to CAPTCHA?

Ironically, I could not get by myself what bgeigr meant, but almighty Google helped me out: So this captcha is quite easy for computers to guess, yet may be hard for humans. And bear in mind that ...
user avatar
64 votes
Accepted

Showing "this is secure" on credit card entry screen

Funny thing, I just did the research on this recently, because we faced the same "issue" in our e-commerce shop. There is a good Baymard article referencing exactly this: Visually Reinforce ...
user avatar
  • 6,716
63 votes
Accepted

Why do some websites (including Google) trim whitespaces in passwords?

Good observation. In my experience this happens for a number of reasons, some intentional and some unintentional. Intentional reasons to trim whitespace: Users often cut and paste passwords (yes, ...
user avatar
  • 40.3k
63 votes

"Typocaptcha" - an alternative to CAPTCHA?

Why would this be indecipherable to a computer? Since each word has the correct letters, but they are scrambled, it would seem very easy for me for a computer to crack the correct order of the letters ...
user avatar
  • 1,267
62 votes
Accepted

Stop user opening links in a new tab

You're looking at the problem from the wrong angle. A user could also open a different browser, or use a second device, which means you can't rely on the idea of opening tabs(and preventing it), nor ...
user avatar
  • 780
51 votes
Accepted

Does a password strength indicator increase password strength?

Researchers from Carnegie Mellon University recently (2012) looked at password strength meters and its impact on password creation. The paper "How does your password measure up? The effect of strength ...
user avatar
  • 3,580
45 votes

Should passwords expire?

No. All you're doing is pushing the security requirement into the domain of the user when really it's your concern if the data you are protecting is serious. In this case it doesn't matter what you ...
user avatar
  • 7,818
43 votes
Accepted

"Typocaptcha" - an alternative to CAPTCHA?

This is not effective for keeping out a targeted attack by someone who uses a word list, such as /usr/share/dict/words, to solve your anagrams. A task like "unscramble the words in standard input, ...
user avatar
41 votes

Stop user opening links in a new tab

On any site, it is not ideal to break a user's expectations. As a user expects to be able to navigate the internet using tabs in their browser, you shouldn't break it.
user avatar
  • 41.6k
38 votes
Accepted

Does the padlock icon make users perceive your site as safer?

In general it should improve perception of security, but user perceptions are a funny thing. Consider example 8 on these surprising AB Testing results. In this instance the security seal on the form ...
user avatar
  • 12.4k
36 votes

"Typocaptcha" - an alternative to CAPTCHA?

tl;dr A good captcha would need (ideally) to offer the best possible protection (difficult to get for a computer) and ease of use (easy to get for a human). But captchas aren't good at this and "...
user avatar
35 votes

Is it good idea to send user password upon register?

Passwords should not be stored in plain text anywhere including the users email inbox. What happens if his email is compromised or if he's entered the wrong email address and someone else receives the ...
user avatar
  • 1,783
32 votes

Does a password strength indicator increase password strength?

Password strength indicator does not, per se, guarantee stronger passwords - from a pure UX perspective the more complex your requirements are the more likely people are to click away, to use an ...
user avatar
  • 1,098
31 votes
Accepted

Why do financial institutions use usernames instead of emails for login?

There are a number of reasons: It prevents someone causing someone elses account to be locked maliciously (if I know your email address and you bank with Barclays I can lock you out of your account ...
user avatar
26 votes
Accepted

How to increase users' perception of security on a payment screen?

Google and UC Berkeley tested different solutions to understand users perception of HTTPS in the browser. While this is not specifically geared to a payment page, their paper contains some strong ...
user avatar
  • 426
25 votes

Should passwords expire?

The quick answer: Amazon, Google and my bank don't make me change my password every six months, or indeed ever. What do you do that requires more security* than they do? Let's hope for your users' ...
user avatar
  • 351
21 votes

Why do financial institutions use usernames instead of emails for login?

I can speak from the bank accounts I know in europe: You don't even need an email address to have an online banking account, as registration usually happens offline - you get Pin and everything via ...
user avatar
  • 316
21 votes
Accepted

Reset password, appropriate response if email doesn't exist?

The easiest way to implement this is to say If a matching account was found an email was sent to user@email.com to allow you to reset your password. I've seen this on a few sites lately, though at ...
user avatar
18 votes

"Typocaptcha" - an alternative to CAPTCHA?

I couldn't believe that I could Macaulay uesdnatnrd what I was radioing: the phenomenal power of the human mind. According to a research team at Cambridge Nerviness, it doesn’t matter in what order ...
user avatar
  • 1,877
17 votes

Is it good idea to send user password upon register?

Please don't. I snagged (myfirstname)@gmail.com several years ago. There are a few other people who share my first name, and they occasionally forget that their email address is not (myfirstname)@...
user avatar
  • 3,623
16 votes

How to increase users' perception of security on a payment screen?

Baymard has done a number of studies on the subject of perceived webpage security, summarized in this article. Some key points: Throughout all of our testing of checkout processes, we’ve ...
user avatar
15 votes

How best to securely present personal info in a members account page

I think a thing that you can do is something similar to Amazon. When you try to access your bills or profile in amazon, you are asked to login again, since it may be possible that you just forgot to ...
user avatar
  • 470
14 votes

Showing "this is secure" on credit card entry screen

How about, possibly in addition to logos, adding a link entitled something like "Security of your information" or "Security details". When the user clicks the link, a paragraph of security details is ...
user avatar
  • 561
13 votes
Accepted

Allowing every password of 6+ characters. Good practice?

I'm pretty sure you have seen this: Source: http://xkcd.com/936/ In other words: Length alone can be good enough as security requirement.
user avatar
12 votes

Stop user opening links in a new tab

Google hangout has the same requirement as your application. You cannot do two hangouts at the same time. Yet Google does not shock the user by disconnecting the first call when a second call is ...
user avatar
12 votes

Should passwords expire?

Accepted wisdom among security experts is that password expiration/forced changes do not, in general increase security, and often decrease it. Frequent changes do not make the password harder to ...
user avatar
  • 1,877
11 votes

Why warn about caps lock for passwords, instead of ignoring caps lock for password characters?

The core reason that you don't want to do this is because, as a general rule, any time you override the standard behavior of a users device, you open yourself up to a bad user experience . . . ...
user avatar
  • 576
10 votes

Should passwords expire?

No, changing passwords every six months won't make the accounts more secure. You still use the same password rules (a Capital letter, a number, a symbol, a gang sign, a hieroglyph and the blood of a ...
user avatar

Only top scored, non community-wiki answers of a minimum length are eligible