Making security usable
Articles
App lock
Native App Lock is useful, but not everyone has access to it or knows where to find it. If your app contains sensitive information, give users an App Lock inside the product too.
Link preview
Link previews help users see what they’re opening, but generating one can leak the user’s IP to any URL shared in chat. Let users disable previews and prefer server-side generation.
Passkey
Passkeys remove the password attackers try to steal through phishing, but users won’t discover them alone. Offer a passkey right after a successful password login, when the friction is fresh.
Incognito mode
Face ID and passkeys stop the wrong person from getting in, but not the right person’s screen from being read. Give users a one-tap privacy mode close to the sensitive data.
Malicious link warning
A link inside a product feels trusted, but the sender may not be. Warn users early, show the real destination, and flag known-malicious links before they open.
Security cooldown
Security warnings get skipped when the primary button is instantly clickable. A short cooldown gives users just enough time to actually read what they’re confirming.
Account recovery
Users stay logged in for years while their email and phone quietly go stale. Verify recovery methods periodically, before the user actually needs them.
Remember me, Keep me signed in, Remember this device
Three controls, not three names for one: remember an email, hold a session, or skip MFA. Label each precisely and never default the risky ones on.
Step-up authentication
A logged-in session proves someone signed in once, not that the person acting now is the owner. Ask for fresh proof of identity at sensitive actions.
On-screen keyboard
Built to defeat keyloggers, on-screen keyboards are bypassed by modern malware and fight against autofill. Passkeys and password managers do the job now.
Last used login method
A “last used” badge is good UX and safe while the hint lives on the device — but a security problem the moment it’s derived server-side from an entered email.
Login page redesign warning
A sudden login redesign looks like phishing to security-aware users. A short announcement before and after launch turns it from a threat into an upgrade.
Password requirements
Prevent users from using their email or commonly used passwords. Show it upfront in a checklist, validate in real-time.
Soft password lockout
Warn users before the final failed attempt, explain what will happen next, show a real countdown timer, and always provide a recovery path through password reset.
Password reset
Reset flows should clearly communicate what happens to existing sessions. If they don’t, users are left unsure whether they’ve actually regained control of their account.
If you have any questions, contact Sviatoslav Nytka.