64
votes
Accepted
Showing "this is secure" on credit card entry screen
Funny thing, I just did the research on this recently, because we faced the same "issue" in our e-commerce shop.
There is a good Baymard article referencing exactly this:
Visually Reinforce ...
- 6,816
26
votes
Accepted
How to increase users' perception of security on a payment screen?
Google and UC Berkeley tested different solutions to understand users perception of HTTPS in the browser. While this is not specifically geared to a payment page, their paper contains some strong ...
- 426
22
votes
Accepted
Reset password, appropriate response if email doesn't exist?
The easiest way to implement this is to say
If a matching account was found an email was sent to [email protected] to allow you to reset your password.
I've seen this on a few sites lately, though at ...
- 881
16
votes
How to increase users' perception of security on a payment screen?
Baymard has done a number of studies on the subject of perceived webpage security, summarized in this article. Some key points:
Throughout all of our testing of checkout processes, we’ve ...
- 161
15
votes
How best to securely present personal info in a members account page
I think a thing that you can do is something similar to Amazon.
When you try to access your bills or profile in amazon, you are asked to login again, since it may be possible that you just forgot to ...
- 468
14
votes
Showing "this is secure" on credit card entry screen
How about, possibly in addition to logos, adding a link entitled something like "Security of your information" or "Security details". When the user clicks the link, a paragraph of security details is ...
- 561
11
votes
Why warn about caps lock for passwords, instead of ignoring caps lock for password characters?
The core reason that you don't want to do this is because, as a general rule, any time you override the standard behavior of a users device, you open yourself up to a bad user experience . . . ...
- 576
9
votes
Accepted
What's the reason behind not notifying users that they entered a wrong email when they recover their password?
First, I thought they try to prevent attackers from randomly guessing email addresses and checking whether they are registered or not. Imagine you know that [email protected] is registered to, e....
- 295
9
votes
Users aren't allowed to reuse old passwords for security reasons. How to alleviate this pain point?
Switch to two-factor authentication and reduce the frequency of forced password changes.
BTW, your system storing their last 12 passwords, even encrypted, is a major security problem. A hacker who ...
- 12.1k
8
votes
Accepted
Force log out users on applying a password policy?
A good password system relies on hashing (1-way encryption) and so cannot check to see if existing passwords comply with rules about criteria (video here:https://youtu.be/yoMOAIzBSpY and here: https://...
- 14.2k
8
votes
Accepted
How to emphasize that downloads may be a malicious to users?
There are two important things I could read through:
1) 99% users do not have trouble
2) Explicit warning message is needed
So considering both cases, you could go with Option 4, but additionally ...
- 3,899
8
votes
Accepted
Android: Why do I have to unlock my phone to turn off WiFi?
It's a safety measure to track your phone (using Android Device Manager) in case it gets lost or stolen. You can check more information here: https://support.google.com/accounts/answer/6160491?hl=en ...
- 1,733
8
votes
What's the reason behind not notifying users that they entered a wrong email when they recover their password?
You don't want anyone knowing even that someone has an account.
If a malicious actor is searching for info on someone, it could be potentially damaging just knowing that someone even has an account / ...
- 24.6k
7
votes
What is the recommended time before a reset password link expires?
The closest thing to a standard that I found is the OWASP Forgot Password Cheat Sheet, which says:
no more than 20 minutes or so
- 71
7
votes
How to best implement "check-in" feature of rewards app
People are making a lot of sense from the software side, but I think we need to look deeper. You essentially don't want people to be an expense without providing revenue. In that case, what's to stop ...
7
votes
Show user 'Access denied' page or redirect to landing page
There's a 3rd option for security concerns: denying a page exists
Working on enterprise software, I've come across feature request for customers who used our platform:
Customers who do not want to ...
- 24.6k
7
votes
Showing "this is secure" on credit card entry screen
I would suggest to make the bar on top of the page - in a different color - with an arrow pointing up to URL line and text saying something like "If you see small green lock in the URL line, then you ...
- 171
7
votes
Users aren't allowed to reuse old passwords for security reasons. How to alleviate this pain point?
The NIST has a policy for passwords that can be helpful to answer your question. First you should talk again to your security team. The NIST has deleted their policy to force users change their ...
- 71
6
votes
How best to securely present personal info in a members account page
Short answer: it's paranoia (but see note):
Some very personal information should be masked, for example, credit card number, but you already do it. Anything else will just make customers experience ...
- 5,053
6
votes
What is the best mobile number authorization strategy?
Both are equally good in terms of security.
According to me the first senerio is good enough and adapted one.
We are used to first senerio.
The second senerio doesn't making much changes and ...
- 1,428
6
votes
Improving on the abcdef password
Okay, regardless of whether you're just talking to someone about it (because they've had a whinge about passwords etc) or you're trying to present a better user interface on a website or some app, I ...
- 3,826
6
votes
Best options for designing my own customised captcha-type process?
Captcha is inherently not user-friendly, as it is a barrier to content that has no relevance on the user experience. Trying to roll your own captcha process is going to not achieve what you are trying ...
- 171
6
votes
Accepted
Verifying an account with SMS as opposed to email address
A lot of people use their phone to sign up for services. Having to go to your messages to copy the code and then drop it into the interface can be slower than just going into your email client and ...
- 9,851
6
votes
Accepted
Should keyboard suggestion bar be enabled when typing password?
It’s a bad practice for security reasons:
If a user types in the password, a bystander could take a quick look. It’s way easier to read a suggestion than to follow the keys the user enters. While the ...
- 3,946
5
votes
What is the recommended time before a reset password link expires?
There doesn't appear to be a standard.
https://postmarkapp.com/guides/password-reset-email-best-practices has a password email reset guide that includes this information:
Expiration information
...
- 607
5
votes
Lets the user set the password itself or send them one via mail after registration?
I think the third option is the best way to handle it if you want to split the process into two steps. You can display a message after the first step to notify the user he needs to update soon the ...
- 4,481
5
votes
Accepted
Lets the user set the password itself or send them one via mail after registration?
The best way is to let the user set a password. Why?
Most people know why all accounts are safeguarded with passwords, be it people with good technical backgrounds, or none at all. They have ATM ...
- 620
5
votes
Accepted
what's the rationale behind 2-step installers?
There are a number of reasons behind it
Initial buy in : The small app size allows users to quickly buy into the experience of the app while downloading additional information in the background. If ...
- 43.8k
5
votes
How to Handle User Email Confirmation After User Becomes a Paying Customer And Doesn't Confirm Email
The time when user requests for the email change, send them the confirmation link and till the time the new email ID gets confirmed, treat the earlier email address as the primary email.
Just make ...
- 1,267
5
votes
Accepted
2FA into the login page (without email or phone number)
Reasons I could think of why 2FA is on a separate page:
Sense of security
If you are using 2FA, you want your account to be more secure at the expense of ease of use. I would guess that users will ...
- 2,443
Only top scored, non community-wiki answers of a minimum length are eligible