Best practices for login pages?

security login usability shibboleth
Joe Lencioni picture Joe Lencioni · Oct 28, 2008 · Viewed 17.7k times · Source

I am working on a single sign-on login page using Shibboleth that will be used for a variety of web applications. Obviously we would like to make this page as secure and usable as possible while limiting the effects of phishing scams.

What are the best practices to keep in mind when designing a login page?

Some questions that have come up around this issue:

  • Is it important for the login page to always look the same on every display?
  • Conversely, would it be beneficial for the login page to have a random design?
  • Is it better for the login page to look the same as all of your other pages or should it have its own unique design?
  • If the login page has its own unique design, should it incorporate other constant elements from your site's design (such as global navigation)?
  • Is the login page an appropriate place to provide the user with additional content (such as latest news)?
  • Are there any additional security features that should be included to help keep people safe?

Answer

scunliffe picture scunliffe · Oct 28, 2008

Usability notes:

Personally I hate when sites put the "forgot password" or "forgot username" or "help" links inbetween the password field, and the Login button. As a keyboard user, I shouldn't have to TAB over them to get to the submit button.

Better yet, also capture the Enter keypress on the password field so that I can auto-submit with the Enter key.

Related questions

Removing the remembered login and password list in SQL Server Management Studio

I've recently used our company's spare laptop (that has a general user set up) while mine was being repaired. I've checked the "Remember password" option in SQL Server Management Studio when logging in to the database. I need to clear …

Read More
Node.js https pem error: routines:PEM_read_bio:no start line

I am messing with login form right now with node.js, I tried creating a pem key and csr using openssl req -newkey rsa:2048 -new -nodes -keyout key.pem -out csr.pem However I been getting errors for running node …

Read More
Should I hash the password before sending it to the server side?

I noticed that most sites send the passwords as plain text over HTTPS to the server. Is there any advantage if instead of that I sent the hash of the password to the server? Would it be more secure?

Read More