8

Switch to two-factor authentication and reduce the frequency of forced password changes. BTW, your system storing their last 12 passwords, even encrypted, is a major security problem. A hacker who steals and figures out how to decrypt them will have 12 guesses for all of their other accounts online.


7

The NIST has a policy for passwords that can be helpful to answer your question. First you should talk again to your security team. The NIST has deleted their policy to force users change their password periodically. The NIST Digital Identity Guidelines FAQ states: Verifiers SHOULD NOT require memorized secrets to be changed arbitrarily (e.g., ...


4

I would use 2FA on login if the user has enabled it. 2FA can be annoying for users so get it out of the way up front at login where a user would expect it to be and keep the user logged in. You can always ask for 2FA authentication again if the user hasn't provided it in a while and they need to do something which requires extra security. Remember that you ...


4

Some options to consider: Two-factor authentication. I'm not a fan, but it might be better than what you have if it would reduce the frequency of password changes. It doesn't make much sense to require two-factor every 30-minutes from the same location, so consider limiting its use to once daily or upon IP/location changes. Also, beware of SIM swap scams. ...


4

The closest thing to a standard that I found is the OWASP Forgot Password Cheat Sheet, which says: no more than 20 minutes or so


2

Mask it, but: allow it to be revealed via a click include a copy to clipboard icon next to it Although API keys are too long to be memorable via shoulder-surfing, they are vulnerable to high-resolution video recordings or photographs (e.g., surveillance cameras or film crews who dropped by for an interview). There are several documented instances of ...


2

Potential disadvantages are numerous: Application should have the access to phone camera (or it cannot work) People are not always OK with sending their pictures Users need to have necessary conditions for making photo (good light, absence of other people or things not for photo) Some countries like Germany are very nervous about people's privacy (it ...


2

"As users are able to store personal information including their payment details, this level of verification is needed." Actually, it should only be needed if/when something strange/unusual/out-of-the-ordinary happens regarding the account that has authenticated with a single factor. I.e. 2FA OTP is an annoying step, it is slow and prone to problems (like ...


2

As per maxathousand's comment: it should be based on a risk assessment. I would add that it should also be based on consideration of you users and their routines. The existence of session windows allows a User to access a system without having to relog, sometimes it may go further in allowing a User to pick-up where they left-off (i.e. avoid having to ...


2

The questions you are asking are geared more towards a survey and that would be my method of getting the answer the Qs you are proposing. If a survey is too blunt, then simply monitoring the number of users who are signing in using 2FA, in comparison to those who have started the process and not completed it, those whom have read information and not ...


1

Since this is the UX StackExchange, I will answer around the user experience concepts associated with F2A. Need Applications have F2A authentication to protect a user from identify theft and monetary theft and the company from legal action for Personally Identifiable Information(PII) being released. Skipping F2A or OTP for verification is simply not an ...


1

There is a rationale (below) for having, and showing, an image that is personal to, or at least recognizable by, the user. However, while a "selfie" will fall into this category, I can't see a reason for only allowing a selfie to be used. One technique to guard against fake (phishing) sites is for a website to show something (e.g. an image) during the ...


1

What you are talking about is a big headache, so, for this reason, your startup needs to think smarter. Actually, I've been doing research on how this process can be done fast and intuitive. I have some suggestions can be applied on personal bases and the other options need 3rd party apps to be applied from your hi-tech company to secure data: 1- Create a ...


1

I guess it depends on who can access the stored API data and the implications of it being copied. If it is in a user account behind a password then, is that enough to keep the information secure? If the API is sensitive information but is not behind a passworded account, then maybe it should be? I would be reluctant to mask it as people accessing the ...


1

Once. A User should be asked to login to a mobile application on their own personal device one time per device/install so as to access data pertaining to their own account. Anything more is implying that their mobile device is not personal and/or the communication channel is insecure (e.g. MITM attacks). Though there is room for considering (worrying about ...


Only top voted, non community-wiki answers of a minimum length are eligible