Questions tagged [user-interface]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
1 vote
1 answer
61 views

Is there a security-related motivation for prompting me for my email address, and then my email and password?

Often when I am signing into web sites, I am prompted for credentials in two steps. First, they ask me to enter my email address. I type it in and click a button. Then they ask me for my password. I ...
0 votes
0 answers
60 views

Why not prompt for password and TOTP simultaneously? [duplicate]

In most common web applications that support multi-factor authentication the user is first prompted for their username and password, and only after a successful first authentication the user is ...
24 votes
9 answers
7k views

Redirect to login page if authorization required -- security flaw?

Suppose we have a site that has public and private areas. The private areas require login. For example "www.site.com/about" is publicly accessible. But "www.site.com/message_inbox"...
2 votes
2 answers
241 views

Why do some password fields allow users to see what they type while others do not?

When I type a password somewhere, I see placeholders (black dots) in place of characters. But sometimes, there is also a toggle button to view the password like in a regular input field (typically an ...
0 votes
2 answers
106 views

is it ok to reveal number of digits in a muti-factor code input screen?

Security-minded UX designer here. Some user interfaces reveal the number of characters in the UI for entering a second-factor security code. Is there risk in doing it this way? How much more secure is ...
0 votes
1 answer
82 views

User associated email address viewable in it's personal settings

Some applications tend to hide completely the user associated email address or just showing a part of it (e.g. f***o@foo.com) in the user's personal settings. Other applications don't mind showing the ...
  • 115
0 votes
1 answer
189 views

For failed logins, what information should be given to users?

When a user fails to successfully login, what information should be given back to them? Normally, we post back "Account not found" or "Incorrect password" or "Incorrect ...
2 votes
3 answers
771 views

Is it safe and permissive to remember devices to skip two factor authentication when dealing with sensitive information?

We're a small UK startup building a small service that allows certain special people (e.g. journalists) to access non-public court information. This information includes a ton of private and ...
  • 121
6 votes
2 answers
294 views

What is the best way to show a (long) number for comparison?

How to represent visually a number (like a key or hash) on a screen for visual comparison with another representation of that number on another screen (or another window) in such way that it would be ...
  • 5,038
51 votes
5 answers
9k views

Why do many websites hide input when entering an OTP?

I've noticed that on many sites, when they ask for a one-time password (OTP) (usually sent by SMS), the input is hidden in the same way as a password field is. My understanding is that once an OTP is ...
1 vote
0 answers
75 views

Is it possible to verify that it's safe to enter social media credentials in a given [IOS, Android, Win10] app?

When logging into web sites using federated login, it's easy to verify that the site that I'm entering my credentials into the site of the identity provider by looking at the address bar and ensuring ...
4 votes
2 answers
401 views

Dealing with violating privacy of registered users during failed authentication

We are forth and back discussing how to deal with privacy issues during failed authentication, password reset and account creation on a web application. Let's say I am in the process of creating an ...
  • 873
2 votes
1 answer
191 views

Why is TLS for email not pushed aggressively to the users likes HTTPS? [closed]

Major browsers like Chrome and Firefox are being more and more aggressive at displaying the security level of websites, for instance warning you when you try to enter passwords on a non-HTTPS website. ...
1 vote
2 answers
132 views

Why ask for username/password after a successful password reset? [duplicate]

I have very, very rarely gone to a site solely to reset my password. Why then, after going through a password reset process, does the conclusion of the process ask me to login again with the new ...
  • 2,147
-1 votes
1 answer
157 views

Credentials After User Locked Out

I'm implementing lockout functionality for a web app where it checks if the user isn't logged in any more or if the user clicks the lockout link, they have to log in again. In some cases (like in ...
3 votes
1 answer
576 views

How do I protect password enteries in Xorg?

I have been doing some reading about security issues with Xorg on Linux, and was surprised to find that you can keylog any GUI application using two shell commands... xinput list xinput test <id ...
3 votes
2 answers
3k views

Is there any reason to disable copy/paste in a website?

I'm asking nearly the same question, but today is related to my bank website, they disabled several functions, including: right click, copying, pasting. Is there any real security implication about ...
4 votes
1 answer
265 views

Will installing a Graphical User Interface in a server be a security problem?

I'm not a CLI-lover, sometimes I prefer to do some tasks in a server using a GUI rather than using the CLI (it speeds up my work), but I don't know if installing a GUI and accessing it using VNC and ...
32 votes
7 answers
5k views

Explain to non tech savvy person how to check that your connection to mybank.com is safe?

I was reading the security advice given by the Swedish Bankers' Association. They included these two pieces of advice (my translation), that I assume is to teach the user to check for SSL/TLS and ...
  • 65.1k
1 vote
3 answers
172 views

How to communicate security expectations to users in an end-to-end encrypted chat app?

I am developing a chat application that has end-to-end encryption, with no third party being able to eavesdrop on conversations. This is rather easy by simply deploying apps that people download and ...
  • 566
9 votes
2 answers
112 views

Personal stylesheets

In reference to this question, I was researching whether or not there would be any security risks in letting users add their own stylesheets. He brings up a scenario in which a dev might use ...
  • 191
28 votes
5 answers
4k views

Why do "Forgotten Password?" links generally reveal usernames or registered email addresses? [duplicate]

It seems that most sites or systems will just state Invalid username or password As a means to not reveal usernames for use in brute force (and other) attacks. Seems like a good idea as a ...
1 vote
2 answers
1k views

Storing unencrypted, confidential data in client memory

I am currently working on a service which lets users store client-side encrypted data and access it anywhere. The client connects through a browser and the webapp is written in JavaScript. To easier ...
  • 500
51 votes
4 answers
16k views

Is having the username and password fields on different pages more secure?

An online bank I use requires inputting your username, navigating to a second page and then entering the password to login. What actual security advantage does this provide, if any?
4 votes
2 answers
684 views

Obscure username input on login forms?

Not (necessarily) a duplicate of: Should both user ID and Password be masked for online banking? Definitely not a duplicate of: Should usernames be kept secret? I can sense your finger on the "mark ...
  • 137
5 votes
4 answers
1k views

Image file as password alternative

I seek guidance on interesting issue. Recently I've been searching for password alternatives, not because of the security, but to be more user-friendly. In one of my projects user receives 128 bits ...
4 votes
2 answers
804 views

Human or Bot: Behind the Scene Checks vs CAPTCHA

I'm working on a web app at the moment where we’re trying to remove any user friction and excess steps from our user creation page. To avoid computer bots completely spamming our app we need to have a ...
  • 43
0 votes
1 answer
447 views

How to minimize vulnerability to UI state interference attacks

Yesterday, Ars Technica posted an article explaining that Android was found to be vulnerable to a UI interference attack. This claim originates from a paper published by Alfred Chen et al. of the ...
  • 281
2 votes
5 answers
2k views

Reply to email or text as verification?

I've seen plenty of websites that, during the signup process, require me to verify my email address or cell phone number by clicking an emailed link or by entering some one-time-use code that's been ...
  • 121
5 votes
1 answer
281 views

Can skeuomorphic UI design create security vulnerabilities?

Skeuomorphic design is common in desktop computer and mobile telephone applications. Sometimes interfaces and cues from the real world are used to good effect (swiping to move backwards and forwards ...
  • 1,201
0 votes
1 answer
233 views

Average user reaction to SSL certificate error pages [closed]

With the attack on Twitter's whois information today, I got into a bit of an argument about whether or not the SSL certificate error messages that web browsers have will actually do any good to ...
  • 255
34 votes
4 answers
4k views

Is it safe to show users why their password is not allowed?

/////////////////////////////// Updated Post Below //////////////////////////// This question has received a lot of hits, more than I ever thought it would have on such a basic topic. So, I thought I ...
5 votes
4 answers
3k views

"Forgot my password page" best practice

On a "forgot my password" page, is appropriate when user doesn't have an account to display the message "this account doesn't exist"? Or in the interest of security, should I display a success message ...
user avatar
-1 votes
1 answer
140 views

Security comparisons between two approaches: how to distinguish FUD from Substance? [closed]

Background: WorkerB and Tymac were discussing the pros-and-cons of using two different alternatives for extending a web content management system that is used in their company. Alternative one ...
  • 371
1 vote
3 answers
1k views

Does Disabling Right Click In Windows Explorer Do Anything?

I am at a student at a school which blocks the right click in Windows Explorer and the desktop, as well as on the taskbar. I don't exactly understand why they do this, since most of the commands on ...
user avatar
17 votes
8 answers
1k views

Should the requirement of admin privileges be extended?

Seeing this comic from xkcd.com made me thinking: Is extending the requirement of admin privileges to things such as connecting to the internet, running the web browser, reading browser and other ...
  • 819
-3 votes
1 answer
1k views

When logging into a web page what exactly happens when a user types the wrong password?

I have two related questions as to what happens when a user tries to log in to a website If the entered password is wrong what should happen? I have two ideas: Redirect to a page saying "wrong ...
  • 10.1k
2 votes
1 answer
970 views

How to achieve interactive shell attack?

Usually when a person gets a shell by attacking some vulnerabilities, what a person gets is non-interactive shell. So when I call FTP interactive client, shell fails. Is there any way I can do ...
  • 53
1 vote
2 answers
143 views

Development-led security vs administration-led security in a software product?

There are cases where you have the opportunity, as a developer, to enforce stricter security features and protections on a software, though they could very well be managed at an environmental level (...
  • 300
3 votes
1 answer
160 views

User Account Notification under Windows useful at all?

IMHO the 'screen dimming'-and-displaying-of-warning-window feature (?) in Windows is extremely annoying, since I routinely run software that does require the permission to modify a lot of things. I ...
  • 2,899
9 votes
1 answer
2k views

How to know the windows security dialog asking for username password is genuine?

I recently faced one issue. It appeared my outlook launched a dialog saying it needed password. It looked like this I noticed the "->" character in the domain name which usually it auto fills. Also ...
  • 193