I loathe organizations that do this, Google being most prominent. Do not force any new steps into a login process without first informing the user! Related: ba

I loathe organizations that do this, Google being most prominent. Do not force any new steps into a login process without first informing the user! Related: banking apps on mobile that log you out after some number of days. They don't tell you at ligingow many days your session is still valid. Just one day, "oh, give me your password". Fortunately I'm savvy enough to have my password safe with my at all times. A less techy user might be on vacation and suddenly get kicked out of critical tools.