Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: Why are sites now breaking login forms into stages (name then password)?

news.ycombinator.com

Post reply on HN
Print view View original

41–50 of 51 posts

Re: Ask HN: Why are sites now breaking login forms into stages (name then password)?

#41

Post by rblatz »

DelaneyM wrote: post #29
natdempk wrote: post #24

Earlier quoted context omitted.

The terminology you're looking for here regarding the differing logins for different organizations is Single Sign-On (SSO) Providers. There are a bunch of different methods of implementing SSO, and companies that offer this as a service. Using the two-step login allows Microsoft, Google, etc. to redirect users to authenticate with their associated SSO Provider based on their username, or in this case email address do…

SSO has nothing in particular to do with two-step login. Two-step login is just a way of getting a branded experience in front of the user as soon as possible, nothing more. It is neither necessary nor indicative of SSO (which you have described correctly.)

>Two-step login is just a way of getting a branded experience in front of the user as soon as possible, nothing more. It is neither necessary nor indicative of SSO (which you have described correctly.)

That might be part of it, but the real point is companies do not want others to MITM their user's passwords.

Re: Ask HN: Why are sites now breaking login forms into stages (name then password)?

#43

Post by tvmalsv »

deegles wrote: post #34
kondbg wrote: post #18

Earlier quoted context omitted.

I've never understood why this is seen as a form of verification. What is stopping a phishing site from simply taking a victim's username and fetching the victim's corresponding image from the bank's website via simple scraping?

I believe it is there so that you don't accidentally lock someone else out of their account if you enter in your username incorrectly (which I have done!)

I had an account with ING Direct and when I created it they asked me what I would like to name it, so I simply entered "checking". Little did I know that you could also use that name as your login name (I always logged in using my account #, I thought the account name was just for display).

Took a few weeks to figure out why I kept getting locked out. Turns out the username "checking" is a pretty popular guess.

Re: Ask HN: Why are sites now breaking login forms into stages (name then password)?

#44

Post by yks »

We use multiple identity providers for users to sign in to our website and we have 2-stage login form to either redirect a user to the identity provider their organization uses or to use our native login/password authentication.

As for Microsoft's login, authenticating users can belong to some Azure Active Directory or Office 365 for Business etc., so Microsoft decides which backend to authenticate users against.

Re: Ask HN: Why are sites now breaking login forms into stages (name then password)?

#45

Post by lprubin »

s_kilk wrote: post #25
J_Darnley wrote: post #6

Earlier quoted context omitted.

> the complexity of [...] two fields If that is true the world is doomed. Giant Meteor 2016

I... I mean... these fuckers can drive, right? They pilot tonne-weight vehicles, at speed, amongst peers. And some of them are responsible for running the power grid, the government, food production, a bunch of other important stuff. They can hold a conversation with another sapient being, and yet a form with two fields is supposedly too much for their minds to deal with? I don't buy it.

A 1% conversion rate increase for some companies is worth millions.

Re: Ask HN: Why are sites now breaking login forms into stages (name then password)?

#46

Post by s_kilk »

Splendor wrote: post #38
s_kilk wrote: post #25

Earlier quoted context omitted.

I... I mean... these fuckers can drive, right? They pilot tonne-weight vehicles, at speed, amongst peers. And some of them are responsible for running the power grid, the government, food production, a bunch of other important stuff. They can hold a conversation with another sapient being, and yet a form with two fields is supposedly too much for their minds to deal with? I don't buy it.

No. Some users cannot drive.

My point is that these are intelligent beings, capable of doing all sorts of amazing things.

We can't presume that our users are no more than slavering beasts, incapable of understanding even the simplest things.

Re: Ask HN: Why are sites now breaking login forms into stages (name then password)?

#47

Post by seekingcharlie »

Anecdotal, but we implemented this as we had a large number of existing users who would sign up on our marketing site (when they were actually trying to sign in).

We changed it so that they enter their email first, then we detect whether we have that email in our db, and direct them to the appropriate next step (either a sign up form as a new user, or a password field for an existing user).

Re: Ask HN: Why are sites now breaking login forms into stages (name then password)?

#48

Post by Artlav »

ajford wrote: post #40
kylecordes wrote: post #2

I'm really looking forward to an answer for us, if someone with deep and relevant knowledge is around. There are a couple of possibilities that come to mind: 1) Perhaps testing reveals that some users are pushed away by the complexity of being confronted with two fields at the same time, and these users are more likely to successfully login presented with only one field at a time. 2) Perhaps there is some actual good…

#3! God it pisses me off so much that Google does this now. I have about 6 different Google accounts (one GApps for Ed, two personal, and three GApps for Business) and it's a pain since I use LastPass, and LP doesn't always get the user matched right. I have to select the right one twice!

Could you explain how "password managers" are a good idea?

I can't seem to grasp the concept, or what makes it more secure to have one password for all your passwords and/or to store all your login credentials on someone else's computer.

Re: Ask HN: Why are sites now breaking login forms into stages (name then password)?

#49

Post by Artlav »

J_Darnley wrote: post #6
kylecordes wrote: post #2

I'm really looking forward to an answer for us, if someone with deep and relevant knowledge is around. There are a couple of possibilities that come to mind: 1) Perhaps testing reveals that some users are pushed away by the complexity of being confronted with two fields at the same time, and these users are more likely to successfully login presented with only one field at a time. 2) Perhaps there is some actual good…

> the complexity of [...] two fields If that is true the world is doomed. Giant Meteor 2016

Not all people are visual thinkers or have large visual bandwidth.

Also, if asking one question at a time adds a % or two to the user base of something as big as Google, then that's a lot of new users.

Re: Ask HN: Why are sites now breaking login forms into stages (name then password)?

#50

Post by bbcbasic »

kondbg wrote: post #27
bbcbasic wrote: post #22

Earlier quoted context omitted.

My bank asks a security question if logging in from an unknown computer before offering the image or allowing entry of the password.

This also provides zero additional security for the end user. Offering security questions and/or images that a user selected does not prove that the site is legitimate, since a phishing site can literally be a reverse proxy to your bank's website that just logs all form values. You can accomplish this in Adding "verification images" or security questions that you set up does not prove that a site is legitimate. A suc…

You are correct.

I consider it just one factor in authenticating the bank but I see your point it could make people less aware or complacent of the EV etc.

Post reply on HN