Questions tagged [user-interface]
The user-interface tag has no usage guidance.
35
questions
0
votes
1answer
68 views
For failed logins, what information should be given to users?
When a user fails to successfully login, what information should be given back to them?
Normally, we post back "Account not found" or "Incorrect password" or "Incorrect ...
1
vote
3answers
171 views
Is it safe and permissive to remember devices to skip two factor authentication when dealing with sensitive information?
We're a small UK startup building a small service that allows certain special people (e.g. journalists) to access non-public court information.
This information includes a ton of private and ...
6
votes
2answers
250 views
What is the best way to show a (long) number for comparison?
How to represent visually a number (like a key or hash) on a screen for visual comparison with another representation of that number on another screen (or another window) in such way that it would be ...
49
votes
5answers
8k views
Why do many websites hide input when entering an OTP?
I've noticed that on many sites, when they ask for a one-time password (OTP) (usually sent by SMS), the input is hidden in the same way as a password field is.
My understanding is that once an OTP is ...
1
vote
0answers
37 views
Is it possible to verify that it's safe to enter social media credentials in a given [IOS, Android, Win10] app?
When logging into web sites using federated login, it's easy to verify that the site that I'm entering my credentials into the site of the identity provider by looking at the address bar and ensuring ...
4
votes
2answers
253 views
Dealing with violating privacy of registered users during failed authentication
We are forth and back discussing how to deal with privacy issues during failed authentication, password reset and account creation on a web application.
Let's say I am in the process of creating an ...
2
votes
1answer
134 views
Why is TLS for email not pushed aggressively to the users likes HTTPS? [closed]
Major browsers like Chrome and Firefox are being more and more aggressive at displaying the security level of websites, for instance warning you when you try to enter passwords on a non-HTTPS website.
...
1
vote
2answers
88 views
Why ask for username/password after a successful password reset? [duplicate]
I have very, very rarely gone to a site solely to reset my password. Why then, after going through a password reset process, does the conclusion of the process ask me to login again with the new ...
-1
votes
1answer
98 views
Credentials After User Locked Out
I'm implementing lockout functionality for a web app where it checks if the user isn't logged in any more or if the user clicks the lockout link, they have to log in again. In some cases (like in ...
2
votes
1answer
322 views
How do I protect password enteries in Xorg?
I have been doing some reading about security issues with Xorg on Linux, and was surprised to find that you can keylog any GUI application using two shell commands...
xinput list
xinput test <id ...
2
votes
2answers
2k views
Is there any reason to disable copy/paste in a website?
I'm asking nearly the same question, but today is related to my bank website, they disabled several functions, including: right click, copying, pasting.
Is there any real security implication about ...
4
votes
1answer
180 views
Will installing a Graphical User Interface in a server be a security problem?
I'm not a CLI-lover, sometimes I prefer to do some tasks in a server using a GUI rather than using the CLI (it speeds up my work), but I don't know if installing a GUI and accessing it using VNC and ...
32
votes
7answers
5k views
Explain to non tech savvy person how to check that your connection to mybank.com is safe?
I was reading the security advice given by the Swedish Bankers' Association. They included these two pieces of advice (my translation), that I assume is to teach the user to check for SSL/TLS and ...
1
vote
3answers
133 views
How to communicate security expectations to users in an end-to-end encrypted chat app?
I am developing a chat application that has end-to-end encryption, with no third party being able to eavesdrop on conversations. This is rather easy by simply deploying apps that people download and ...
9
votes
2answers
74 views
Personal stylesheets
In reference to this question, I was researching whether or not there would be any security risks in letting users add their own stylesheets.
He brings up a scenario in which a dev might use ...
26
votes
5answers
4k views
Why do “Forgotten Password?” links generally reveal usernames or registered email addresses? [duplicate]
It seems that most sites or systems will just state
Invalid username or password
As a means to not reveal usernames for use in brute force (and other) attacks. Seems like a good idea as a ...
1
vote
2answers
985 views
Storing unencrypted, confidential data in client memory
I am currently working on a service which lets users store client-side encrypted data and access it anywhere. The client connects through a browser and the webapp is written in JavaScript. To easier ...
41
votes
4answers
12k views
Is having the username and password fields on different pages more secure?
An online bank I use requires inputting your username, navigating to a second page and then entering the password to login. What actual security advantage does this provide, if any?
4
votes
2answers
612 views
Obscure username input on login forms?
Not (necessarily) a duplicate of: Should both user ID and Password be masked for online banking?
Definitely not a duplicate of: Should usernames be kept secret?
I can sense your finger on the "mark ...
5
votes
4answers
836 views
Image file as password alternative
I seek guidance on interesting issue. Recently I've been searching for password alternatives, not because of the security, but to be more user-friendly.
In one of my projects user receives 128 bits ...
4
votes
2answers
738 views
Human or Bot: Behind the Scene Checks vs CAPTCHA
I'm working on a web app at the moment where we’re trying to remove any user friction and excess steps from our user creation page. To avoid computer bots completely spamming our app we need to have a ...
0
votes
1answer
389 views
How to minimize vulnerability to UI state interference attacks
Yesterday, Ars Technica posted an article explaining that Android was found to be vulnerable to a UI interference attack.
This claim originates from a paper published by Alfred Chen et al. of the ...
2
votes
5answers
1k views
Reply to email or text as verification?
I've seen plenty of websites that, during the signup process, require me to verify my email address or cell phone number by clicking an emailed link or by entering some one-time-use code that's been ...
5
votes
1answer
236 views
Can skeuomorphic UI design create security vulnerabilities?
Skeuomorphic design is common in desktop computer and mobile telephone applications. Sometimes interfaces and cues from the real world are used to good effect (swiping to move backwards and forwards ...
0
votes
1answer
192 views
Average user reaction to SSL certificate error pages [closed]
With the attack on Twitter's whois information today, I got into a bit of an argument about whether or not the SSL certificate error messages that web browsers have will actually do any good to ...
34
votes
4answers
4k views
Is it safe to show users why their password is not allowed?
/////////////////////////////// Updated Post Below ////////////////////////////
This question has received a lot of hits, more than I ever thought it would have on such a basic topic. So, I thought I ...
5
votes
4answers
3k views
“Forgot my password page” best practice
On a "forgot my password" page, is appropriate when user doesn't have an account to display the message "this account doesn't exist"? Or in the interest of security, should I display a success message ...
-1
votes
1answer
104 views
Security comparisons between two approaches: how to distinguish FUD from Substance? [closed]
Background:
WorkerB and Tymac were discussing the pros-and-cons of using two different alternatives for extending a web content management system that is used in their company.
Alternative one ...
2
votes
4answers
1k views
Does Disabling Right Click In Windows Explorer Do Anything?
I am at a student at a school which blocks the right click in Windows Explorer and the desktop, as well as on the taskbar. I don't exactly understand why they do this, since most of the commands on ...
17
votes
8answers
1k views
Should the requirement of admin privileges be extended?
Seeing this comic from xkcd.com made me thinking:
Is extending the requirement of admin privileges to things such as connecting to the internet, running the web browser, reading browser and other ...
-3
votes
1answer
973 views
When logging into a web page what exactly happens when a user types the wrong password?
I have two related questions as to what happens when a user tries to log in to a website
If the entered password is wrong what should happen?
I have two ideas:
Redirect to a page saying "wrong ...
2
votes
1answer
805 views
How to achieve interactive shell attack?
Usually when a person gets a shell by attacking some vulnerabilities, what a person gets is non-interactive shell.
So when I call FTP interactive client, shell fails.
Is there any way I can do ...
1
vote
2answers
104 views
Development-led security vs administration-led security in a software product?
There are cases where you have the opportunity, as a developer, to enforce stricter security features and protections on a software, though they could very well be managed at an environmental level (...
3
votes
1answer
125 views
User Account Notification under Windows useful at all?
IMHO the 'screen dimming'-and-displaying-of-warning-window feature (?) in Windows is extremely annoying, since I routinely run software that does require the permission to modify a lot of things. I ...
9
votes
1answer
1k views
How to know the windows security dialog asking for username password is genuine?
I recently faced one issue. It appeared my outlook launched a dialog saying it needed password. It looked like this
I noticed the "->" character in the domain name which usually it auto fills. Also ...
