Comments on: Experience a gorgeous ULX-powered login site (and let us know what you think) https://www.incontextblog.com/?p=633 Mon, 31 Oct 2011 19:13:46 +0000 hourly 1 https://wordpress.org/?v=3.1.1 By: J. Trent Adams https://www.incontextblog.com/?p=633&cpage=1#comment-14891 J. Trent Adams Thu, 05 Aug 2010 04:52:19 +0000 https://www.incontextblog.com/?p=633#comment-14891 Paul - Even though you're disappointed with the security concerns brought up by the group, did you ultimately agree with the outcome? Curious. Paul -

Even though you’re disappointed with the security concerns brought up by the group, did you ultimately agree with the outcome?

Curious.

]]> By: paul https://www.incontextblog.com/?p=633&cpage=1#comment-14890 paul Wed, 04 Aug 2010 23:23:11 +0000 https://www.incontextblog.com/?p=633#comment-14890 I see that you added the username/password box to the popup in your mockup. I had originally thought the same thing: we wanted to unify un/pw with OpenID, SAML, etc. and have them all on the same surface of the pop up. But some of our group strongly felt that doing so would lead to phishing attacks. The rationale was that user's really don't think much when they see un/pw widgets, they immediately start typing in credentials--and sometimes the wrong credentials. Thus, the thought was that without the additional context of the full site (e.g. the pubmed.gov site in this case) the user may well accidentally input non-pubmed.gov credentials. Personally I was very disappointed with this--in other words I agree with you! I see that you added the username/password box to the popup in your mockup. I had originally thought the same thing: we wanted to unify un/pw with OpenID, SAML, etc. and have them all on the same surface of the pop up. But some of our group strongly felt that doing so would lead to phishing attacks. The rationale was that user’s really don’t think much when they see un/pw widgets, they immediately start typing in credentials–and sometimes the wrong credentials. Thus, the thought was that without the additional context of the full site (e.g. the pubmed.gov site in this case) the user may well accidentally input non-pubmed.gov credentials. Personally I was very disappointed with this–in other words I agree with you!

]]> By: Mat Hamlin https://www.incontextblog.com/?p=633&cpage=1#comment-14889 Mat Hamlin Wed, 04 Aug 2010 18:39:35 +0000 https://www.incontextblog.com/?p=633#comment-14889 The previous comment stripped my HTML. https://flic.kr/p/8pxTSE The previous comment stripped my HTML.

https://flic.kr/p/8pxTSE

]]> By: Mat Hamlin https://www.incontextblog.com/?p=633&cpage=1#comment-14888 Mat Hamlin Wed, 04 Aug 2010 18:37:33 +0000 https://www.incontextblog.com/?p=633#comment-14888 Nice job masking the complexity of an identity provider and providing the end user an understandable and actionable path to cross-protocol login. I know each provider has their own login window, but to make it the most usable, it would be interesting to investigate if something like this would be possible instead of the pop-up: <a href="https://www.flickr.com/photos/simplyidentity/4860999758/" title="KantaraUXLogin_w_textboxes by SimplyIdentity, on Flickr" rel="nofollow"></a> Nice job masking the complexity of an identity provider and providing the end user an understandable and actionable path to cross-protocol login.

I know each provider has their own login window, but to make it the most usable, it would be interesting to investigate if something like this would be possible instead of the pop-up:

]]>