User Data

User Data

1. User Input

   • Login process
     • Incorrect input from user
       • Further access to site functions denied
         • Error message displayed
           • e.g. "Account not found" "invalid password"
     • User inputs valid credentials, e.g valid email and password
       • User gains access to what his permissions allow him
         • Profile management
           • Ability to manage the data of others if necessary permissions are acquired
   • Signup
     • User inputs data such as their intended username, email, and password
       • Safety measures such as entering password twice are put in place
         • Certain data fields require criteria
           • Email must have '@' and '.com'
           • Password requires minimum amount of characters, a capital letter, a number
             • Requirements displayed on page
               • When any above requirements are not met, the offending data field is cleared and a notification is given to the user.
               • When registration is successful, the user's data is added to the database and login can be conducted when matching data is entered
           • Phone number must be a certain amount of digits as they are otherwise invalid
   • Managing profile details
     • Similar input validation rules are applied as in the login process

2. Input validation

   • Usage of data fields for users to enter in, using different data types in SQL DB
     • User details
       • varchar, as user input for username and password contains a mix of symbols letters and numbers
         • Do the provided credentials match existing ones stored in database?
           • If not, error message is shown and a redirection to teh signup page is offered for user.
           • If yes, login is successful.
       • NOT NULL, as these fields need to be filled in order for the user to log in or sign up
       • Password change request
         • Request made when already logged in
           • User enters their existing password, then their desired new password
             • User is asked again to enter new password as a safety feature
               • This makes it more difficult for the user to make a serious mistake
         • Request is made without being logged in
           • User is required to enter a valid username/email in order for the process to start
             • External verification factor is required from user
       • Integer can be used for phone number, as a phone number only includes numbers
     • Verification code (if required)
       • Integer or varchar as verification codes tend to be short strings of letters, numbers, or both
         • If incorrectly entered, data field is erased and a notification is given to the user
           • Options such as generating or creating a new code are provided

3. User Privacy

   • Adherence to Australia Privacy Principles(APP)
     • User anonymity and pseudonymity
       • Users have the option of maintaining their own privacy
         • Ability to not identify themselves or use a pseudonym on the service
     • Open and clear privacy policy
       • User should have access to all relevant policy to what is being done with their data
     • Collection of user information
       • Notification of the collection of personal info
         • Clear indications need to be given
       • Applications can only collect personal information under certain circumstances
     • Security and access to personal information