Questions tagged [user-interface]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
4
votes
4answers
646 views

Image file as password alternative

I seek guidance on interesting issue. Recently I've been searching for password alternatives, not because of the security, but to be more user-friendly. In one of my projects user receives 128 bits ...
32
votes
7answers
5k views

Explain to non tech savvy person how to check that your connection to mybank.com is safe?

I was reading the security advice given by the Swedish Bankers' Association. They included these two pieces of advice (my translation), that I assume is to teach the user to check for SSL/TLS and ...
32
votes
5answers
10k views

Is having the username and password fields on different pages more secure?

An online bank I use requires inputting your username, navigating to a second page and then entering the password to login. What actual security advantage does this provide, if any?
5
votes
4answers
2k views

“Forgot my password page” best practice

On a "forgot my password" page, is appropriate when user doesn't have an account to display the message "this account doesn't exist"? Or in the interest of security, should I display a success message ...
1
vote
0answers
35 views

Is it possible to verify that it's safe to enter social media credentials in a given [IOS, Android, Win10] app?

When logging into web sites using federated login, it's easy to verify that the site that I'm entering my credentials into the site of the identity provider by looking at the address bar and ensuring ...
4
votes
2answers
225 views

Dealing with violating privacy of registered users during failed authentication

We are forth and back discussing how to deal with privacy issues during failed authentication, password reset and account creation on a web application. Let's say I am in the process of creating an ...
2
votes
1answer
130 views

Why is TLS for email not pushed aggressively to the users likes HTTPS? [closed]

Major browsers like Chrome and Firefox are being more and more aggressive at displaying the security level of websites, for instance warning you when you try to enter passwords on a non-HTTPS website. ...
1
vote
2answers
84 views

Why ask for username/password after a successful password reset? [duplicate]

I have very, very rarely gone to a site solely to reset my password. Why then, after going through a password reset process, does the conclusion of the process ask me to login again with the new ...
-1
votes
1answer
87 views

Credentials After User Locked Out

I'm implementing lockout functionality for a web app where it checks if the user isn't logged in any more or if the user clicks the lockout link, they have to log in again. In some cases (like in ...
2
votes
1answer
235 views

How do I protect password enteries in Xorg?

I have been doing some reading about security issues with Xorg on Linux, and was surprised to find that you can keylog any GUI application using two shell commands... xinput list xinput test <id ...
1
vote
2answers
2k views

Is there any reason to disable copy/paste in a website?

I'm asking nearly the same question, but today is related to my bank website, they disabled several functions, including: right click, copying, pasting. Is there any real security implication about ...
4
votes
1answer
160 views

Will installing a Graphical User Interface in a server be a security problem?

I'm not a CLI-lover, sometimes I prefer to do some tasks in a server using a GUI rather than using the CLI (it speeds up my work), but I don't know if installing a GUI and accessing it using VNC and ...
1
vote
3answers
130 views

How to communicate security expectations to users in an end-to-end encrypted chat app?

I am developing a chat application that has end-to-end encryption, with no third party being able to eavesdrop on conversations. This is rather easy by simply deploying apps that people download and ...
9
votes
2answers
72 views

Personal stylesheets

In reference to this question, I was researching whether or not there would be any security risks in letting users add their own stylesheets. He brings up a scenario in which a dev might use ...
26
votes
5answers
3k views

Why do “Forgotten Password?” links generally reveal usernames or registered email addresses? [duplicate]

It seems that most sites or systems will just state Invalid username or password As a means to not reveal usernames for use in brute force (and other) attacks. Seems like a good idea as a ...
1
vote
2answers
830 views

Storing unencrypted, confidential data in client memory

I am currently working on a service which lets users store client-side encrypted data and access it anywhere. The client connects through a browser and the webapp is written in JavaScript. To easier ...
4
votes
2answers
567 views

Obscure username input on login forms?

Not (necessarily) a duplicate of: Should both user ID and Password be masked for online banking? Definitely not a duplicate of: Should usernames be kept secret? I can sense your finger on the "mark ...
0
votes
1answer
374 views

How to minimize vulnerability to UI state interference attacks

Yesterday, Ars Technica posted an article explaining that Android was found to be vulnerable to a UI interference attack. This claim originates from a paper published by Alfred Chen et al. of the ...
4
votes
2answers
719 views

Human or Bot: Behind the Scene Checks vs CAPTCHA

I'm working on a web app at the moment where we’re trying to remove any user friction and excess steps from our user creation page. To avoid computer bots completely spamming our app we need to have a ...
2
votes
5answers
969 views

Reply to email or text as verification?

I've seen plenty of websites that, during the signup process, require me to verify my email address or cell phone number by clicking an emailed link or by entering some one-time-use code that's been ...
33
votes
4answers
4k views

Is it safe to show users why their password is not allowed?

/////////////////////////////// Updated Post Below //////////////////////////// This question has received a lot of hits, more than I ever thought it would have on such a basic topic. So, I thought I ...
9
votes
1answer
1k views

How to know the windows security dialog asking for username password is genuine?

I recently faced one issue. It appeared my outlook launched a dialog saying it needed password. It looked like this I noticed the "->" character in the domain name which usually it auto fills. Also ...
5
votes
1answer
230 views

Can skeuomorphic UI design create security vulnerabilities?

Skeuomorphic design is common in desktop computer and mobile telephone applications. Sometimes interfaces and cues from the real world are used to good effect (swiping to move backwards and forwards ...
0
votes
1answer
192 views

Average user reaction to SSL certificate error pages [closed]

With the attack on Twitter's whois information today, I got into a bit of an argument about whether or not the SSL certificate error messages that web browsers have will actually do any good to ...
2
votes
4answers
1k views

Does Disabling Right Click In Windows Explorer Do Anything?

I am at a student at a school which blocks the right click in Windows Explorer and the desktop, as well as on the taskbar. I don't exactly understand why they do this, since most of the commands on ...
-1
votes
1answer
104 views

Security comparisons between two approaches: how to distinguish FUD from Substance? [closed]

Background: WorkerB and Tymac were discussing the pros-and-cons of using two different alternatives for extending a web content management system that is used in their company. Alternative one ...
17
votes
8answers
1k views

Should the requirement of admin privileges be extended?

Seeing this comic from xkcd.com made me thinking: Is extending the requirement of admin privileges to things such as connecting to the internet, running the web browser, reading browser and other ...
-3
votes
1answer
864 views

When logging into a web page what exactly happens when a user types the wrong password?

I have two related questions as to what happens when a user tries to log in to a website If the entered password is wrong what should happen? I have two ideas: Redirect to a page saying "wrong ...
2
votes
1answer
766 views

How to achieve interactive shell attack?

Usually when a person gets a shell by attacking some vulnerabilities, what a person gets is non-interactive shell. So when I call FTP interactive client, shell fails. Is there any way I can do ...
1
vote
2answers
102 views

Development-led security vs administration-led security in a software product?

There are cases where you have the opportunity, as a developer, to enforce stricter security features and protections on a software, though they could very well be managed at an environmental level (...
3
votes
1answer
125 views

User Account Notification under Windows useful at all?

IMHO the 'screen dimming'-and-displaying-of-warning-window feature (?) in Windows is extremely annoying, since I routinely run software that does require the permission to modify a lot of things. I ...