Live data from Hacker News

Ask HN: Why are sites now breaking login forms into stages (name then password)?

news.ycombinator.com

1–10 of 51 posts

Ask HN: Why are sites now breaking login forms into stages (name then password)?

#1
I've noticed this trend now where you are first asked for your username or email first, then the page reloads with the password box separately. This is really annoying if you use a password manager as you sometimes have to open it twice. Where has this come from? Is it safer?

Re: Ask HN: Why are sites now breaking login forms into stages (name then password)?

#2
I'm really looking forward to an answer for us, if someone with deep and relevant knowledge is around. There are a couple of possibilities that come to mind:

1) Perhaps testing reveals that some users are pushed away by the complexity of being confronted with two fields at the same time, and these users are more likely to successfully login presented with only one field at a time.

2) Perhaps there is some actual good security reason for it.

3) Perhaps there is some bad security reason for it. First example, lots of sites appear to express a belief that password managers are evil, and that users must be forced by increasingly obstinate means to type each long detailed robust password one single character at a time. Maybe this is simply an extension of that somehow.

4) Perhaps a security standard somewhere was devised that for some reason (good or bad) demanded this behavior; then it has been copied across the industry ever since.

Re: Ask HN: Why are sites now breaking login forms into stages (name then password)?

#4
The only justification I've ever seen was places gearing up for multi-factor authentication. The front login page, asking for your account, tells the backend how you're configured to login (token, password, biometric, whatever). Then the second page is variable depending on your authentication method.

Re: Ask HN: Why are sites now breaking login forms into stages (name then password)?

#6

I'm really looking forward to an answer for us, if someone with deep and relevant knowledge is around. There are a couple of possibilities that come to mind: 1) Perhaps testing reveals that some users are pushed away by the complexity of being confronted with two fields at the same time, and these users are more likely to successfully login presented with only one field at a time. 2) Perhaps there is some actual good…

> the complexity of [...] two fields

If that is true the world is doomed. Giant Meteor 2016

Re: Ask HN: Why are sites now breaking login forms into stages (name then password)?

#9
Microsoft appears to do it as well with Office 365 and Azure (and related services).

They appear to distinguish two types of accounts ('Live ID' type accounts for personal use, and 'Work' accounts) and it is possible for a single e-mail address to refer to both. When I enter my work email, I get to choose between 'use my work account' (which exists in Azure AD) and 'use my personal account' (which some years ago I registered as Live ID), then get the password prompt.

Actually their implementation is a bit annoying, because the password field in some cases is already visible before the choice between personal/work is presented - as soon as you tab out of the username field, you get the choice and you have to type your password afterwards.

Post reply on HN