The user-interface tag has no wiki summary.
0
votes
0answers
22 views
Additional security for services hosted on a 2FA or Multi-Factor Authenticated Network
I am aiming to lock down a web service that accesses other services and has a publicly facing UI.
I have a hosted service on a network that requires 2-factor authentication to access. This service's ...
4
votes
2answers
141 views
Human or Bot: Behind the Scene Checks vs CAPTCHA
I'm working on a web app at the moment where we’re trying to remove any user friction and excess steps from our user creation page. To avoid computer bots completely spamming our app we need to have a ...
0
votes
1answer
136 views
How to minimize vulnerability to UI state interference attacks
Yesterday, Ars Technica posted an article explaining that Android was found to be vulnerable to a UI interference attack.
This claim originates from a paper published by Alfred Chen et al. of the ...
1
vote
5answers
132 views
Reply to email or text as verification?
I've seen plenty of websites that, during the signup process, require me to verify my email address or cell phone number by clicking an emailed link or by entering some one-time-use code that's been ...
5
votes
1answer
181 views
Can skeuomorphic UI design create security vulnerabilities?
Skeuomorphic design is common in desktop computer and mobile telephone applications. Sometimes interfaces and cues from the real world are used to good effect (swiping to move backwards and forwards ...
0
votes
1answer
157 views
Average user reaction to SSL certificate error pages [closed]
With the attack on Twitter's whois information today, I got into a bit of an argument about whether or not the SSL certificate error messages that web browsers have will actually do any good to ...
30
votes
4answers
3k views
Is it safe to show users why their password is not allowed?
/////////////////////////////// Updated Post Below ////////////////////////////
This question has received a lot of hits, more than I ever thought it would have on such a basic topic. So, I ...
5
votes
4answers
937 views
“Forgot my password page” best practice
On a "forgot my password" page, is appropriate when user doesn't have an account to display the message "this account doesn't exist"? Or in the interest of security, should I display a success message ...
0
votes
1answer
83 views
Security comparisons between two approaches: how to distinguish FUD from Substance? [closed]
Background:
WorkerB and Tymac were discussing the pros-and-cons of using two different alternatives for extending a web content management system that is used in their company.
Alternative one ...
2
votes
4answers
526 views
Does Disabling Right Click In Windows Explorer Do Anything?
I am at a student at a school which blocks the right click in Windows Explorer and the desktop, as well as on the taskbar. I don't exactly understand why they do this, since most of the commands on ...
16
votes
8answers
806 views
Should the requirement of admin privileges be extended?
Seeing this comic from xkcd.com made me thinking:
Is extending the requirement of admin privileges to things such as connecting to the internet, running the web browser, reading browser and other ...
-2
votes
1answer
329 views
When logging into a web page what exactly happens when a user types the wrong password?
I have two related questions as to what happens when a user tries to log in to a website
If the entered password is wrong what should happen?
I have two ideas:
Redirect to a page saying "wrong ...
2
votes
1answer
312 views
How to achieve interactive shell attack?
Usually when a person gets a shell by attacking some vulnerabilities, what a person gets is non-interactive shell.
So when I call FTP interactive client, shell fails.
Is there any way I can do ...
1
vote
2answers
89 views
Development-led security vs administration-led security in a software product?
There are cases where you have the opportunity, as a developer, to enforce stricter security features and protections on a software, though they could very well be managed at an environmental level ...
2
votes
1answer
107 views
User Account Notification under Windows useful at all?
IMHO the 'screen dimming'-and-displaying-of-warning-window feature (?) in Windows is extremely annoying, since I routinely run software that does require the permission to modify a lot of things. I ...
8
votes
1answer
905 views
How to know the windows security dialog asking for username password is genuine?
I recently faced one issue. It appeared my outlook launched a dialog saying it needed password. It looked like this
I noticed the "->" character in the domain name which usually it auto fills. Also ...
