Questions tagged [user-interface]
The user-interface tag has no usage guidance.
41
questions
1
vote
1
answer
61
views
Is there a security-related motivation for prompting me for my email address, and then my email and password?
Often when I am signing into web sites, I am prompted for credentials in two steps. First, they ask me to enter my email address. I type it in and click a button. Then they ask me for my password. I ...
- 657
0
votes
0
answers
60
views
Why not prompt for password and TOTP simultaneously? [duplicate]
In most common web applications that support multi-factor authentication the user is first prompted for their username and password, and only after a successful first authentication the user is ...
- 101
24
votes
9
answers
7k
views
Redirect to login page if authorization required -- security flaw?
Suppose we have a site that has public and private areas. The private areas require login.
For example "www.site.com/about" is publicly accessible. But "www.site.com/message_inbox"...
- 331
2
votes
2
answers
241
views
Why do some password fields allow users to see what they type while others do not?
When I type a password somewhere, I see placeholders (black dots) in place of characters. But sometimes, there is also a toggle button to view the password like in a regular input field (typically an ...
- 21
0
votes
2
answers
106
views
is it ok to reveal number of digits in a muti-factor code input screen?
Security-minded UX designer here.
Some user interfaces reveal the number of characters in the UI for entering a second-factor security code. Is there risk in doing it this way?
How much more secure is ...
0
votes
1
answer
82
views
User associated email address viewable in it's personal settings
Some applications tend to hide completely the user associated email address or just showing a part of it (e.g. f***o@foo.com) in the user's personal settings. Other applications don't mind showing the ...
- 115
0
votes
1
answer
189
views
For failed logins, what information should be given to users?
When a user fails to successfully login, what information should be given back to them?
Normally, we post back "Account not found" or "Incorrect password" or "Incorrect ...
- 625
2
votes
3
answers
771
views
Is it safe and permissive to remember devices to skip two factor authentication when dealing with sensitive information?
We're a small UK startup building a small service that allows certain special people (e.g. journalists) to access non-public court information.
This information includes a ton of private and ...
- 121
6
votes
2
answers
294
views
What is the best way to show a (long) number for comparison?
How to represent visually a number (like a key or hash) on a screen for visual comparison with another representation of that number on another screen (or another window) in such way that it would be ...
- 5,038
51
votes
5
answers
9k
views
Why do many websites hide input when entering an OTP?
I've noticed that on many sites, when they ask for a one-time password (OTP) (usually sent by SMS), the input is hidden in the same way as a password field is.
My understanding is that once an OTP is ...
- 572
1
vote
0
answers
75
views
Is it possible to verify that it's safe to enter social media credentials in a given [IOS, Android, Win10] app?
When logging into web sites using federated login, it's easy to verify that the site that I'm entering my credentials into the site of the identity provider by looking at the address bar and ensuring ...
- 295
4
votes
2
answers
401
views
Dealing with violating privacy of registered users during failed authentication
We are forth and back discussing how to deal with privacy issues during failed authentication, password reset and account creation on a web application.
Let's say I am in the process of creating an ...
- 873
2
votes
1
answer
191
views
Why is TLS for email not pushed aggressively to the users likes HTTPS? [closed]
Major browsers like Chrome and Firefox are being more and more aggressive at displaying the security level of websites, for instance warning you when you try to enter passwords on a non-HTTPS website.
...
1
vote
2
answers
132
views
Why ask for username/password after a successful password reset? [duplicate]
I have very, very rarely gone to a site solely to reset my password. Why then, after going through a password reset process, does the conclusion of the process ask me to login again with the new ...
- 2,147
-1
votes
1
answer
157
views
Credentials After User Locked Out
I'm implementing lockout functionality for a web app where it checks if the user isn't logged in any more or if the user clicks the lockout link, they have to log in again. In some cases (like in ...
- 739
3
votes
1
answer
576
views
How do I protect password enteries in Xorg?
I have been doing some reading about security issues with Xorg on Linux, and was surprised to find that you can keylog any GUI application using two shell commands...
xinput list
xinput test <id ...
- 247
3
votes
2
answers
3k
views
Is there any reason to disable copy/paste in a website?
I'm asking nearly the same question, but today is related to my bank website, they disabled several functions, including: right click, copying, pasting.
Is there any real security implication about ...
- 2,465
4
votes
1
answer
265
views
Will installing a Graphical User Interface in a server be a security problem?
I'm not a CLI-lover, sometimes I prefer to do some tasks in a server using a GUI rather than using the CLI (it speeds up my work), but I don't know if installing a GUI and accessing it using VNC and ...
- 2,465
32
votes
7
answers
5k
views
Explain to non tech savvy person how to check that your connection to mybank.com is safe?
I was reading the security advice given by the Swedish Bankers' Association. They included these two pieces of advice (my translation), that I assume is to teach the user to check for SSL/TLS and ...
- 65.1k
1
vote
3
answers
172
views
How to communicate security expectations to users in an end-to-end encrypted chat app?
I am developing a chat application that has end-to-end encryption, with no third party being able to eavesdrop on conversations. This is rather easy by simply deploying apps that people download and ...
- 566
9
votes
2
answers
112
views
Personal stylesheets
In reference to this question, I was researching whether or not there would be any security risks in letting users add their own stylesheets.
He brings up a scenario in which a dev might use ...
- 191
28
votes
5
answers
4k
views
Why do "Forgotten Password?" links generally reveal usernames or registered email addresses? [duplicate]
It seems that most sites or systems will just state
Invalid username or password
As a means to not reveal usernames for use in brute force (and other) attacks. Seems like a good idea as a ...
- 445
1
vote
2
answers
1k
views
Storing unencrypted, confidential data in client memory
I am currently working on a service which lets users store client-side encrypted data and access it anywhere. The client connects through a browser and the webapp is written in JavaScript. To easier ...
- 500
51
votes
4
answers
16k
views
Is having the username and password fields on different pages more secure?
An online bank I use requires inputting your username, navigating to a second page and then entering the password to login. What actual security advantage does this provide, if any?
- 613
4
votes
2
answers
684
views
Obscure username input on login forms?
Not (necessarily) a duplicate of: Should both user ID and Password be masked for online banking?
Definitely not a duplicate of: Should usernames be kept secret?
I can sense your finger on the "mark ...
- 137
5
votes
4
answers
1k
views
Image file as password alternative
I seek guidance on interesting issue. Recently I've been searching for password alternatives, not because of the security, but to be more user-friendly.
In one of my projects user receives 128 bits ...
- 159
4
votes
2
answers
804
views
Human or Bot: Behind the Scene Checks vs CAPTCHA
I'm working on a web app at the moment where we’re trying to remove any user friction and excess steps from our user creation page. To avoid computer bots completely spamming our app we need to have a ...
- 43
0
votes
1
answer
447
views
How to minimize vulnerability to UI state interference attacks
Yesterday, Ars Technica posted an article explaining that Android was found to be vulnerable to a UI interference attack.
This claim originates from a paper published by Alfred Chen et al. of the ...
- 281
2
votes
5
answers
2k
views
Reply to email or text as verification?
I've seen plenty of websites that, during the signup process, require me to verify my email address or cell phone number by clicking an emailed link or by entering some one-time-use code that's been ...
- 121
5
votes
1
answer
281
views
Can skeuomorphic UI design create security vulnerabilities?
Skeuomorphic design is common in desktop computer and mobile telephone applications. Sometimes interfaces and cues from the real world are used to good effect (swiping to move backwards and forwards ...
- 1,201
0
votes
1
answer
233
views
Average user reaction to SSL certificate error pages [closed]
With the attack on Twitter's whois information today, I got into a bit of an argument about whether or not the SSL certificate error messages that web browsers have will actually do any good to ...
- 255
34
votes
4
answers
4k
views
Is it safe to show users why their password is not allowed?
/////////////////////////////// Updated Post Below ////////////////////////////
This question has received a lot of hits, more than I ever thought it would have on such a basic topic. So, I thought I ...
- 489
5
votes
4
answers
3k
views
"Forgot my password page" best practice
On a "forgot my password" page, is appropriate when user doesn't have an account to display the message "this account doesn't exist"? Or in the interest of security, should I display a success message ...
nramirez
-1
votes
1
answer
140
views
Security comparisons between two approaches: how to distinguish FUD from Substance? [closed]
Background:
WorkerB and Tymac were discussing the pros-and-cons of using two different alternatives for extending a web content management system that is used in their company.
Alternative one ...
- 371
1
vote
3
answers
1k
views
Does Disabling Right Click In Windows Explorer Do Anything?
I am at a student at a school which blocks the right click in Windows Explorer and the desktop, as well as on the taskbar. I don't exactly understand why they do this, since most of the commands on ...
user25787
17
votes
8
answers
1k
views
Should the requirement of admin privileges be extended?
Seeing this comic from xkcd.com made me thinking:
Is extending the requirement of admin privileges to things such as connecting to the internet, running the web browser, reading browser and other ...
- 819
-3
votes
1
answer
1k
views
When logging into a web page what exactly happens when a user types the wrong password?
I have two related questions as to what happens when a user tries to log in to a website
If the entered password is wrong what should happen?
I have two ideas:
Redirect to a page saying "wrong ...
- 10.1k
2
votes
1
answer
970
views
How to achieve interactive shell attack?
Usually when a person gets a shell by attacking some vulnerabilities, what a person gets is non-interactive shell.
So when I call FTP interactive client, shell fails.
Is there any way I can do ...
- 53
1
vote
2
answers
143
views
Development-led security vs administration-led security in a software product?
There are cases where you have the opportunity, as a developer, to enforce stricter security features and protections on a software, though they could very well be managed at an environmental level (...
- 300
3
votes
1
answer
160
views
User Account Notification under Windows useful at all?
IMHO the 'screen dimming'-and-displaying-of-warning-window feature (?) in Windows is extremely annoying, since I routinely run software that does require the permission to modify a lot of things. I ...
- 2,899
9
votes
1
answer
2k
views
How to know the windows security dialog asking for username password is genuine?
I recently faced one issue. It appeared my outlook launched a dialog saying it needed password. It looked like this
I noticed the "->" character in the domain name which usually it auto fills. Also ...
- 193