Skip to main content
63 votes
Accepted

Showing "this is secure" on credit card entry screen

Funny thing, I just did the research on this recently, because we faced the same "issue" in our e-commerce shop. There is a good Baymard article referencing exactly this: Visually Reinforce ...
Big_Chair's user avatar
  • 6,835
26 votes
Accepted

How to increase users' perception of security on a payment screen?

Google and UC Berkeley tested different solutions to understand users perception of HTTPS in the browser. While this is not specifically geared to a payment page, their paper contains some strong ...
Wes's user avatar
  • 426
16 votes

How to increase users' perception of security on a payment screen?

Baymard has done a number of studies on the subject of perceived webpage security, summarized in this article. Some key points: Throughout all of our testing of checkout processes, we’ve ...
kcazllerraf's user avatar
14 votes

Showing "this is secure" on credit card entry screen

How about, possibly in addition to logos, adding a link entitled something like "Security of your information" or "Security details". When the user clicks the link, a paragraph of security details is ...
usul's user avatar
  • 561
9 votes
Accepted

What's the reason behind not notifying users that they entered a wrong email when they recover their password?

First, I thought they try to prevent attackers from randomly guessing email addresses and checking whether they are registered or not. Imagine you know that [email protected] is registered to, e....
Drown's user avatar
  • 295
9 votes

Users aren't allowed to reuse old passwords for security reasons. How to alleviate this pain point?

Switch to two-factor authentication and reduce the frequency of forced password changes. BTW, your system storing their last 12 passwords, even encrypted, is a major security problem. A hacker who ...
Izquierdo's user avatar
  • 12.7k
8 votes
Accepted

How to emphasize that downloads may be a malicious to users?

There are two important things I could read through: 1) 99% users do not have trouble 2) Explicit warning message is needed So considering both cases, you could go with Option 4, but additionally ...
Amit Jain's user avatar
  • 3,919
8 votes
Accepted

Force log out users on applying a password policy?

A good password system relies on hashing (1-way encryption) and so cannot check to see if existing passwords comply with rules about criteria (video here:https://youtu.be/yoMOAIzBSpY and here: https://...
Roux Martin's user avatar
  • 14.2k
8 votes
Accepted

Android: Why do I have to unlock my phone to turn off WiFi?

It's a safety measure to track your phone (using Android Device Manager) in case it gets lost or stolen. You can check more information here: https://support.google.com/accounts/answer/6160491?hl=en ...
Joao Carvalho's user avatar
8 votes

What's the reason behind not notifying users that they entered a wrong email when they recover their password?

You don't want anyone knowing even that someone has an account. If a malicious actor is searching for info on someone, it could be potentially damaging just knowing that someone even has an account / ...
Mike M's user avatar
  • 24.7k
8 votes

Users aren't allowed to reuse old passwords for security reasons. How to alleviate this pain point?

The NIST has a policy for passwords that can be helpful to answer your question. First you should talk again to your security team. The NIST has deleted their policy to force users change their ...
Torben's user avatar
  • 81
7 votes

What is the recommended time before a reset password link expires?

The closest thing to a standard that I found is the OWASP Forgot Password Cheat Sheet, which says: no more than 20 minutes or so
Maxim Y's user avatar
  • 71
7 votes

How to best implement "check-in" feature of rewards app

People are making a lot of sense from the software side, but I think we need to look deeper. You essentially don't want people to be an expense without providing revenue. In that case, what's to stop ...
Travis Don Kindred's user avatar
7 votes

Show user 'Access denied' page or redirect to landing page

There's a 3rd option for security concerns: denying a page exists Working on enterprise software, I've come across feature request for customers who used our platform: Customers who do not want to ...
Mike M's user avatar
  • 24.7k
7 votes

Showing "this is secure" on credit card entry screen

I would suggest to make the bar on top of the page - in a different color - with an arrow pointing up to URL line and text saying something like "If you see small green lock in the URL line, then you ...
gilhad's user avatar
  • 171
6 votes

What is the best mobile number authorization strategy?

Both are equally good in terms of security. According to me the first senerio is good enough and adapted one. We are used to first senerio. The second senerio doesn't making much changes and ...
Abhishek Sharma's user avatar
6 votes

Best options for designing my own customised captcha-type process?

Captcha is inherently not user-friendly, as it is a barrier to content that has no relevance on the user experience. Trying to roll your own captcha process is going to not achieve what you are trying ...
Jonathan Kempf's user avatar
6 votes

Improving on the abcdef password

Okay, regardless of whether you're just talking to someone about it (because they've had a whinge about passwords etc) or you're trying to present a better user interface on a website or some app, I ...
Monomeeth's user avatar
  • 3,826
6 votes
Accepted

Verifying an account with SMS as opposed to email address

A lot of people use their phone to sign up for services. Having to go to your messages to copy the code and then drop it into the interface can be slower than just going into your email client and ...
Wendy Wojenka's user avatar
6 votes
Accepted

Should keyboard suggestion bar be enabled when typing password?

It’s a bad practice for security reasons: If a user types in the password, a bystander could take a quick look. It’s way easier to read a suggestion than to follow the keys the user enters. While the ...
unor's user avatar
  • 3,956
5 votes

Lets the user set the password itself or send them one via mail after registration?

I think the third option is the best way to handle it if you want to split the process into two steps. You can display a message after the first step to notify the user he needs to update soon the ...
Madalina Taina's user avatar
5 votes

What is the recommended time before a reset password link expires?

There doesn't appear to be a standard. https://postmarkapp.com/guides/password-reset-email-best-practices has a password email reset guide that includes this information: Expiration information ...
Joshua Dance's user avatar
5 votes
Accepted

Lets the user set the password itself or send them one via mail after registration?

The best way is to let the user set a password. Why? Most people know why all accounts are safeguarded with passwords, be it people with good technical backgrounds, or none at all. They have ATM ...
Varun Nair's user avatar
5 votes
Accepted

what's the rationale behind 2-step installers?

There are a number of reasons behind it Initial buy in : The small app size allows users to quickly buy into the experience of the app while downloading additional information in the background. If ...
Mervin's user avatar
  • 44k
5 votes

How to Handle User Email Confirmation After User Becomes a Paying Customer And Doesn't Confirm Email

The time when user requests for the email change, send them the confirmation link and till the time the new email ID gets confirmed, treat the earlier email address as the primary email. Just make ...
Sanshizm's user avatar
  • 1,267
5 votes
Accepted

2FA into the login page (without email or phone number)

Reasons I could think of why 2FA is on a separate page: Sense of security If you are using 2FA, you want your account to be more secure at the expense of ease of use. I would guess that users will ...
Nash's user avatar
  • 2,451
4 votes

Should we ask for name on card even though it's not required for credit card payments?

As said by anthonyryan1, it is required for American Express. So either you ask for/require this information only for American Express (which would mean you would either have to ask the user for the ...
CherryDT's user avatar
  • 141
4 votes

UX and Information Security of pre-login account information

Do a value analysis to understand if users value privacy more than the utility provided in your site / app's context. For instance nobody wants that for a bank or an escort site, but for Amazon? Why ...
Steve Dodier-Lazaro's user avatar
4 votes
Accepted

Why are OTP password fields masked?

Due to the inherent inertia of user expectations. Users have been conditioned to expect their characters to be masked in a real password entry field, so we mask the password to match expectations.
Andrew Neely's user avatar
4 votes

How to best implement "check-in" feature of rewards app

What if a Temporary QR code is Randomly Generated in the Rewards App, and then scanned in the premises? So, here is the story - 1) When I want to check-in, I fire the rewards app, and it generates a ...
Amit Jain's user avatar
  • 3,919

Only top scored, non community-wiki answers of a minimum length are eligible