3 ms·
It's at the intersection of security and user experience. Changing your password because you think it's been compromised is a different use case from changing
by mooism2 17y ago
It's at the intersection of security and user experience. Changing your password because you think it's been compromised is a different use case from changing your password because you've been using it for years or forgotten it.
- cgranade 17y agoAt the risk of encouraging Yet Another Warning, would displaying a notice after changing passwords that sites are still authorized be a solution? I'd say that it should have links to more info and to the Connections page, but I despair of users giving up at any sign of warnings. As looking at the issues with that infamous little "lock" icon to indicate HTTPS shows, security and UX intersections are always difficult.
- mooism2 17y agoPossibly display a list of recently authorised sites (and when they were authorised), and make it easy to revoke them without going to another page. It's difficult because people don't expect another step after they've changed their password, and (I'd guess) wouldn't immediately understand the need for it. Perhaps the answer is Yet Another Configuration Setting: the default option revokes all site authorisations when you change your password; the alternate option allows (but forces) you to think about it.