Ask HN: Why do we now show username/password fields on separate screens?

Post by gtirloni » Sun, Dec 13, 2020, 12:23 PM UTC

ironmagma wrote: post #7

Those who are saying SSO should take note that it’s not really necessary to use this pattern for SSO. For example, Microsoft uses the pattern that they will redirect you as soon as your email looks like an SSO email. This has the benefit of allowing a user to enter their password before their username (not doing so being a major pet peeve of mine when copying a password from a password manager).

Post by ironmagma » Sun, Dec 13, 2020, 4:06 PM UTC

gtirloni wrote: post #11

ironmagma wrote: post #7

Those who are saying SSO should take note that it’s not really necessary to use this pattern for SSO. For example, Microsoft uses the pattern that they will redirect you as soon as your email looks like an SSO email. This has the benefit of allowing a user to enter their password before their username (not doing so being a major pet peeve of mine when copying a password from a password manager).

Microsoft SSO is a shit show. You login and it says wait logging you off. Then you have to try again.

Post by fred_is_fred » Mon, Dec 14, 2020, 12:17 AM UTC

kayman wrote: post #12

fred_is_fred wrote: post #10

While we're on this topic, why have some sites started refusing to prompt me for my password and instead are sending codes to my email. slack.com is a great example. It's like 2FA without the first factor.

It’s because the average person has so many passwords in various formats that they forget. But that person most likely has access to their email. Instead of taking the user on a password reset journey, just shortcut to login. The attack vector is restricted to email no matter what.