Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Single input login form

awayback.com

Post reply on HN
Print view View original

51–60 of 61 posts

Re: Single input login form

#51

Post by techbio »

aquark wrote: post #41
johnwatson11218 wrote: post #28

Earlier quoted context omitted.

Does everyone agree about that last point? That having a single error message that says "username/password combo not found" is more secure? I have always thought that the username was not secret and to treat it as part of the secret is almost like saying there is no username just a big password that you enter in two distinct boxes. I understand that hackers do like ways to validate that they have an actual username a…

I understand the security argument about not giving out more information than you absolutely need to. But, I hate 'low-risk' sites that do this when I'm not sure of my username/password. If I can't remember what username I used 6 months ago when I signed up then at least tell me I got that wrong instead of trying different passwords. Even better, scratch usernames and let me log in with my email address.

This.

Re: Single input login form

#52

Post by Groxx »

techbio wrote: post #51
aquark wrote: post #41

Earlier quoted context omitted.

I understand the security argument about not giving out more information than you absolutely need to. But, I hate 'low-risk' sites that do this when I'm not sure of my username/password. If I can't remember what username I used 6 months ago when I signed up then at least tell me I got that wrong instead of trying different passwords. Even better, scratch usernames and let me log in with my email address.

This.

"This." == clicking the up-arrow.

Re: Single input login form

#54

Post by pavel_lishin »

eps wrote: post #13
alanh wrote: post #7

Please, please don’t use this. 1. Besides the obvious UX problem of unfamiliarity, I would also expect some people (myself included) to worry about whether or not their password will be masked. 2. The “Password” placeholder in the mockup is actually impossible to reliably implement (on the web)… consider a 44-character username, for starters. 3. You are now responsible for removing the password from the DOM on page b…

With regards to #2 - the assumption with his design appears to be that the input field is long enough to fit the longest username and the password. Given that both the username and the password lengths are typically capped at relatively short values, the assumption is reasonable. But even if there is an overflow, I don't really see it being a problem - the password is no different from a regular input except that all…

> both the username and the password lengths are typically capped at relatively short values

What? They are? The only place I've seen this is on bank websites.

Re: Single input login form

#56

Post by toast76 »

I actually think this is an awesome idea.

I'd just make a couple of small changes though. Instead of using space to start entering your password, I'd use the TAB key (as people are familiar with it). Then, to make it more obvious to the user the separation (and protection) of their password and user name, I'd put the password in a second text box and label it "password".

The benefit of this approach is that I think users would be comfortable with it, it works with all modern browsers (without JS) and I think it will be a fairly easy to change our existing forms to suit.

Re: Single input login form

#57

Post by Groxx »

techbio wrote: post #55
Groxx wrote: post #52

Earlier quoted context omitted.

"This." == clicking the up-arrow.

TY, but it was meant with a tone of finality the up arrow lacks.

If that is the case, it probably deserve(s|d) a reason for support. "This." contains zero content aside from approval - functionally identical to the arrow, but at a much higher waste for everyone who encounters it.

Re: Single input login form

#58

Post by pbhjpbhj »

evanchen wrote: post #53

There's no significant problem to solve here.

>There's no significant problem to solve here.

I've had to enter username/passwords in to a mobile phone in the last couple of weeks and it's painful - I can see a unified input working for that. In short I see a problem that this may be a solution to (it was also mentioned in the comments of the linked article).

Of course my mobile provider could fix that one with a better interface too (it's not a smart phone).

Re: Single input login form

#59

Post by techbio »

Groxx wrote: post #57
techbio wrote: post #55

Earlier quoted context omitted.

TY, but it was meant with a tone of finality the up arrow lacks.

If that is the case, it probably deserve(s|d) a reason for support. "This." contains zero content aside from approval - functionally identical to the arrow, but at a much higher waste for everyone who encounters it.

OK! OK I get it already.

Sorry I like simplicity when I'm not dealing with my banking and medical records.

Re: Single input login form

#60

Post by ggruschow »

Alexx wrote: post #42
ggruschow wrote: post #36

Alternative : There's no reason for my username to be public on the vast majority of sites/apps/crap that I use, so I'd rather just have a username, no password. The secret username can be associated with a display name, real name, physical/email addresses, etc. You can use the latter to look up the former along with a password/probing question/ping (email, text, phone) to retrieve the former. It seems to make more s…

The main problem with this is that it would greatly increase the effectiveness of brute-force attacks. The secret username would have to be forced to be a long string without dictionary words, numbers, capitalization etc, which somewhat undoes any potential advantage. Even then it's not very secure in comparison. Even if a potential intruder does know a username, there is only one possible pass key, but by removing t…

You could just make min(len(secret_username)) = 1 + min(len(username)) + min(len(password))... if that's what you wanted.

Not all systems need to have the same level of security though, nor do they all need to assume their users are ignorant.

Post reply on HN