Bank of America and Vanguard both used to do this, but within the last year both switched to a single stage login, and both said they were switching to single stage to improve security.
Ask HN: Why are sites now breaking login forms into stages (name then password)?
31–40 of 51 posts
Re: Ask HN: Why are sites now breaking login forms into stages (name then password)?
#32I've seen this on some bank websites, that display a user-selected picture after giving them your user ID. I guess that is so the user can verify that they are talking to the legitimate site.
I've never understood why this is seen as a form of verification. What is stopping a phishing site from simply taking a victim's username and fetching the victim's corresponding image from the bank's website via simple scraping?
That's probably why many of my bank/credit logins present that option anymore. Most of mine have moved back to the single-form style of login.
Re: Ask HN: Why are sites now breaking login forms into stages (name then password)?
#33Many sites have started using "magic links" where you can choose to either receive an email with a link that will authenticate you or you can input the password. Both Netflix and Slack does this.
Medium don't even offer a password version - it's social network OAuth or this.
Re: Ask HN: Why are sites now breaking login forms into stages (name then password)?
#34I've seen this on some bank websites, that display a user-selected picture after giving them your user ID. I guess that is so the user can verify that they are talking to the legitimate site.
I've never understood why this is seen as a form of verification. What is stopping a phishing site from simply taking a victim's username and fetching the victim's corresponding image from the bank's website via simple scraping?
I believe it is there so that you don't accidentally lock someone else out of their account if you enter in your username incorrectly (which I have done!)
Re: Ask HN: Why are sites now breaking login forms into stages (name then password)?
#35Earlier quoted context omitted.
The terminology you're looking for here regarding the differing logins for different organizations is Single Sign-On (SSO) Providers. There are a bunch of different methods of implementing SSO, and companies that offer this as a service. Using the two-step login allows Microsoft, Google, etc. to redirect users to authenticate with their associated SSO Provider based on their username, or in this case email address do…
SSO has nothing in particular to do with two-step login. Two-step login is just a way of getting a branded experience in front of the user as soon as possible, nothing more. It is neither necessary nor indicative of SSO (which you have described correctly.)
The custom Microsoft login for the university example cited is an implementation of SSO
Re: Ask HN: Why are sites now breaking login forms into stages (name then password)?
#36Earlier quoted context omitted.
My bank asks a security question if logging in from an unknown computer before offering the image or allowing entry of the password.
This also provides zero additional security for the end user. Offering security questions and/or images that a user selected does not prove that the site is legitimate, since a phishing site can literally be a reverse proxy to your bank's website that just logs all form values. You can accomplish this in Adding "verification images" or security questions that you set up does not prove that a site is legitimate. A suc…
Have you played "What's Your Porn Name?" You combine your first pet's name and your mother's maiden name...
Re: Ask HN: Why are sites now breaking login forms into stages (name then password)?
#37Atlassian HipChat.
Re: Ask HN: Why are sites now breaking login forms into stages (name then password)?
#38Earlier quoted context omitted.
> the complexity of [...] two fields If that is true the world is doomed. Giant Meteor 2016
I... I mean... these fuckers can drive, right? They pilot tonne-weight vehicles, at speed, amongst peers. And some of them are responsible for running the power grid, the government, food production, a bunch of other important stuff. They can hold a conversation with another sapient being, and yet a form with two fields is supposedly too much for their minds to deal with? I don't buy it.
No. Some users cannot drive.
Re: Ask HN: Why are sites now breaking login forms into stages (name then password)?
#39The only place I've seen this done is Google. For them it makes sense. Since a long time ago, they've had a feature where you use your custom authentication service to sign in (think: on site Kerberos instance). For example at school the form would show both email and password fields, but I would enter only my school email into the username and then it would redirect me to to my school's centralized login. So now ins…
IIRC, Paychex & Bonobos have a 2 page login
Re: Ask HN: Why are sites now breaking login forms into stages (name then password)?
#40I'm really looking forward to an answer for us, if someone with deep and relevant knowledge is around. There are a couple of possibilities that come to mind: 1) Perhaps testing reveals that some users are pushed away by the complexity of being confronted with two fields at the same time, and these users are more likely to successfully login presented with only one field at a time. 2) Perhaps there is some actual good…
#3! God it pisses me off so much that Google does this now. I have about 6 different Google accounts (one GApps for Ed, two personal, and three GApps for Business) and it's a pain since I use LastPass, and LP doesn't always get the user matched right. I have to select the right one twice!