Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: Why are sites now breaking login forms into stages (name then password)?

news.ycombinator.com

Post reply on HN
Print view View original

21–30 of 51 posts

Re: Ask HN: Why are sites now breaking login forms into stages (name then password)?

#21

Post by z1mm32m4n »

scandox wrote: post #16
z1mm32m4n wrote: post #13

The only place I've seen this done is Google. For them it makes sense. Since a long time ago, they've had a feature where you use your custom authentication service to sign in (think: on site Kerberos instance). For example at school the form would show both email and password fields, but I would enter only my school email into the username and then it would redirect me to to my school's centralized login. So now ins…

Tumblr does it

I'm not saying there aren't others; I'm just giving perspective into why one instance I know about.

Re: Ask HN: Why are sites now breaking login forms into stages (name then password)?

#22

Post by bbcbasic »

kondbg wrote: post #18
derekp7 wrote: post #12

I've seen this on some bank websites, that display a user-selected picture after giving them your user ID. I guess that is so the user can verify that they are talking to the legitimate site.

I've never understood why this is seen as a form of verification. What is stopping a phishing site from simply taking a victim's username and fetching the victim's corresponding image from the bank's website via simple scraping?

My bank asks a security question if logging in from an unknown computer before offering the image or allowing entry of the password.

Re: Ask HN: Why are sites now breaking login forms into stages (name then password)?

#23

Post by ktta »

zero_by_divide wrote: post #4

The only justification I've ever seen was places gearing up for multi-factor authentication. The front login page, asking for your account, tells the backend how you're configured to login (token, password, biometric, whatever). Then the second page is variable depending on your authentication method.

Is that the only real reason? blockchain.info immediately pops up a 2FA input bar depending on the previous inputs, not a second page.

Re: Ask HN: Why are sites now breaking login forms into stages (name then password)?

#24

Post by natdempk »

red_admiral wrote: post #14

Several large sites, including google/gmail and MS, do this so they can offer separate corporate versions of their cloud products. When you enter your username, it checks whether this is a consumer or corporate username, then the password page you see actually comes from a completely different page. Try going to login.microsoftonline.com which has both a username and a password field and then type "alpha@bristol.ac.u…

The terminology you're looking for here regarding the differing logins for different organizations is Single Sign-On (SSO) Providers. There are a bunch of different methods of implementing SSO, and companies that offer this as a service. Using the two-step login allows Microsoft, Google, etc. to redirect users to authenticate with their associated SSO Provider based on their username, or in this case email address domain, so that this login can be shared across other services a company utilizes.

Re: Ask HN: Why are sites now breaking login forms into stages (name then password)?

#25

Post by s_kilk »

J_Darnley wrote: post #6
kylecordes wrote: post #2

I'm really looking forward to an answer for us, if someone with deep and relevant knowledge is around. There are a couple of possibilities that come to mind: 1) Perhaps testing reveals that some users are pushed away by the complexity of being confronted with two fields at the same time, and these users are more likely to successfully login presented with only one field at a time. 2) Perhaps there is some actual good…

> the complexity of [...] two fields If that is true the world is doomed. Giant Meteor 2016

I... I mean... these fuckers can drive, right? They pilot tonne-weight vehicles, at speed, amongst peers. And some of them are responsible for running the power grid, the government, food production, a bunch of other important stuff. They can hold a conversation with another sapient being, and yet a form with two fields is supposedly too much for their minds to deal with?

I don't buy it.

Re: Ask HN: Why are sites now breaking login forms into stages (name then password)?

#27

Post by kondbg »

bbcbasic wrote: post #22
kondbg wrote: post #18

Earlier quoted context omitted.

I've never understood why this is seen as a form of verification. What is stopping a phishing site from simply taking a victim's username and fetching the victim's corresponding image from the bank's website via simple scraping?

My bank asks a security question if logging in from an unknown computer before offering the image or allowing entry of the password.

This also provides zero additional security for the end user. Offering security questions and/or images that a user selected does not prove that the site is legitimate, since a phishing site can literally be a reverse proxy to your bank's website that just logs all form values. You can accomplish this in Adding "verification images" or security questions that you set up does not prove that a site is legitimate. A successfully established HTTPS connection to the bank's domain is necessary and sufficient to guarantee authenticity (and most banks use EV too, which browsers make extra obvious).

Users should be trained to look at the URL bar for the green EV indicator, instead of being trained to believe that a site is legitimate simply because it displays a picture that they select. Banks that encourage this behavior are actively encouraging users to become even more gullible to well-crafted phishing attacks.

Re: Ask HN: Why are sites now breaking login forms into stages (name then password)?

#28

Post by allenbrunson »

Nadya wrote: post #5

I've yet to encounter this - do you have an example site? It seems.. wrong and backwards.

oddly enough, the very low-tech website for the company that holds my mortgage does this. i can't imagine it's for any of the reasons people are speculating about here. based on the presentation, i think it's purely to simplify the interface. i guess it's less daunting to have to enter only one piece of information at a time.

Re: Ask HN: Why are sites now breaking login forms into stages (name then password)?

#29

Post by DelaneyM »

natdempk wrote: post #24
red_admiral wrote: post #14

Several large sites, including google/gmail and MS, do this so they can offer separate corporate versions of their cloud products. When you enter your username, it checks whether this is a consumer or corporate username, then the password page you see actually comes from a completely different page. Try going to login.microsoftonline.com which has both a username and a password field and then type "alpha@bristol.ac.u…

The terminology you're looking for here regarding the differing logins for different organizations is Single Sign-On (SSO) Providers. There are a bunch of different methods of implementing SSO, and companies that offer this as a service. Using the two-step login allows Microsoft, Google, etc. to redirect users to authenticate with their associated SSO Provider based on their username, or in this case email address do…

SSO has nothing in particular to do with two-step login.

Two-step login is just a way of getting a branded experience in front of the user as soon as possible, nothing more. It is neither necessary nor indicative of SSO (which you have described correctly.)

Post reply on HN