New Approaches To Designing Log-In Forms

#1

Post by cwan » Mon, Aug 22, 2011, 2:45 PM UTC

New Approaches To Designing Log-In Forms
uxdesign.smashingmagazine.com

Re: New Approaches To Designing Log-In Forms

#2

Post by Tichy » Mon, Aug 22, 2011, 3:33 PM UTC

Revealing user names (As in "you are trying to log in as Luke") is usually considered a security issue, though.

Re: New Approaches To Designing Log-In Forms

#3

Post by lambada » Mon, Aug 22, 2011, 3:54 PM UTC

Didn't Facebook get bad press a while ago for revealing the user's name and profile picture when an incorrect password was entered?

Re: New Approaches To Designing Log-In Forms

#4

Post by cancelbubble » Mon, Aug 22, 2011, 4:02 PM UTC

Horrible privacy and security issues in this, IMO.

Re: New Approaches To Designing Log-In Forms

#5

Post by phlamb » Mon, Aug 22, 2011, 4:03 PM UTC

Tichy wrote: post #2

Revealing user names (As in "you are trying to log in as Luke") is usually considered a security issue, though.

This was my first thought as well. I thought it was bad when it just verified that you had used a correct username after attempting to log in, then I kept reading and saw the auto-complete combobox of usernames...

Re: New Approaches To Designing Log-In Forms

#6

Post by thatjoshguy » Mon, Aug 22, 2011, 4:14 PM UTC

If you mistype your email address in Facebook, it will suggest your correct account on login fail. I'm not sure if it just does this blindly, or if it tracks where you are logging in from.

Re: New Approaches To Designing Log-In Forms

#7

Post by bitdiffusion » Mon, Aug 22, 2011, 4:40 PM UTC

I was always under the impression that security trumps user-experience in the majority of cases - what happened to trying to prevent malicious users from harvesting user names by using captcha, non-specific error messages etc? Maybe I've had my head buried in the security game for too long...

Re: New Approaches To Designing Log-In Forms

#8

Post by typicalrunt » Mon, Aug 22, 2011, 4:42 PM UTC

So for the Quora login form that determines whether someone's email address has already registered on the system... What's to stop me from: - looking at the source code, - finding the JavaScript call to the REST service that checks for an account - writing a script to loop through all well-known domains and usernames?

Tada! Instant email scraping tool.

Re: New Approaches To Designing Log-In Forms

#9

Post by yesimahuman » Mon, Aug 22, 2011, 4:42 PM UTC

Here is another one I've experimented with: No passwords. You get a login key in the first email we send, or you can request a new email to log in.

Your email is the weakest link in a lot of password-based schemes anyways, but this approach is less secure and a bit confusing.

Re: New Approaches To Designing Log-In Forms

#10

Post by typicalrunt » Mon, Aug 22, 2011, 4:46 PM UTC

typicalrunt wrote: post #8

So for the Quora login form that determines whether someone's email address has already registered on the system... What's to stop me from: - looking at the source code, - finding the JavaScript call to the REST service that checks for an account - writing a script to loop through all well-known domains and usernames? Tada! Instant email scraping tool.

Actually, I re-read the article just to make sure that I wasn't being too critical. I'm not. The author doesn't mention any security risks/benefits associated with the new login form designs.

It reminds me of the time when a former boss asked me to add authentication onto the company intranet. She wanted to know who is logging in and viewing private documents, but she didn't like typing in or remembering passwords so I could only ask users for their username and "trust" that they wouldn't type in someone else's username instead. For some (probably most) users, security isn't on the forefront of their mind, so they need to be reminded of it.