21–29 of 29 posts
Here is another one I've experimented with: No passwords. You get a login key in the first email we send, or you can request a new email to log in. Your email is the weakest link in a lot of password-based schemes anyways, but this approach is less secure and a bit confusing.
Here is another one I've experimented with: No passwords. You get a login key in the first email we send, or you can request a new email to log in. Your email is the weakest link in a lot of password-based schemes anyways, but this approach is less secure and a bit confusing.
This is a great idea, but is it hard to implement with non-technical users?
I think it's interesting but in practice passwords are more secure and people are used to them.
I was always under the impression that security trumps user-experience in the majority of cases - what happened to trying to prevent malicious users from harvesting user names by using captcha, non-specific error messages etc? Maybe I've had my head buried in the security game for too long...
Security should trump UX. In practice, though, UX almost always seems to trump security concerns.
In my view, security is just another part of the user experience. For one's bank, it's surely a large one. For most web services, though, it's pretty tiny. As a Quora user, I'm perfectly happy for them to increase usability substantially at the cost of a minor increase in risk.
Earlier quoted context omitted.
I believe revealing whether or not an email address has an account is also considered a security issue.
Validation on registration form reveals this already.
Earlier quoted context omitted.
Validation on registration form reveals this already.
Well-designed registration forms should not reveal this. Our registration forms provide the error "Email address or password is incorrect. Please try again." Further, forgotten password forms, etc. should also not reveal this.
Revealing user names (As in "you are trying to log in as Luke") is usually considered a security issue, though.
(edit) In a context of a system that allows anyone to register new account, which appears to be what the linked article focuses on.
Revealing user names (As in "you are trying to log in as Luke") is usually considered a security issue, though.
How so? Please do elaborate. (edit) In a context of a system that allows anyone to register new account, which appears to be what the linked article focuses on.
Of course it depends on the context. On Hacker News all user names are visible anyway.
Earlier quoted context omitted.
Well-designed registration forms should not reveal this. Our registration forms provide the error "Email address or password is incorrect. Please try again." Further, forgotten password forms, etc. should also not reveal this.
Pssst... the registration form, not the login form. As in sorry, we cannot create you an account as your selected username has already been taken .