Jerome Chadel

Designing for Usability vs Security

OneSign is the Single Sign-On (SSO) and authentication application created by Imprivata. It is mainly used in healthcare environment.

 

One set of credentials to rule them all

Clinicians don't need to authenticate each time they need to open their applications. 

 

multi-factor authentication

Administrators can choose different identification factors based on

Group 31.png

For this work, my goal was to redesign the PIN creation experience.  

Originally, the only parameter controlled in the OneSign administration console was the PIN length: the maximum number of digits in a PIN, a value set by an administrator. 

This simple configuration didn't prevent users to create PINs like: 1111, or 1234, or 1212. 

 

My team and I decided to conduct some research to understand what a secure PIN might look like. We interviewed several Security Administrators and came up with new rules where a PIN:

  • cannot have more than 2 repetitions
  • cannot have any consecutive numbers
  • cannot be identical to a certain number of previous created PINs.

 

To make the experience usable I decided to use several type of feedback as you type.

When the user is starting to create his/her PIN, the requirements displayed above the input field are validated in real time. 

 

In this screenshot, you can see that while the user types his PIN, the green check marks shows that the PIN has the right length, and does not repeat a single digit. However since the PIN is made of consecutive numbers, a red mark is highlighted plus the PIN combination is changing in red as well. 

1476847134485.jpeg

This Imprivata OneSign feature was extremely well received both internally, and by our customers as well, because although it allows administrators to set stronger rules for a more secure PIN, the creation experience was even more enjoyable than before.