Entering an email address first, and then the password, is needed for systems that support SSO.
If you're dealing with enterprise users, supporting SSO is the most important thing you can do to keep logins quick and seamless.
Don’t Get Clever with Login Forms
391–400 of 520 posts
Re: Don’t Get Clever with Login Forms
#392Another rule: make all fields pastable. If you have a form I can't fill in with my password manager, I can copy and paste my username and password with my password manager. Unless... you make those fields so I can't paste into them. Then, I have to open two windows side by side and manually type in my 16 digit password with caps, numbers, and symbols. Tedious.
[deleted]
Re: Don’t Get Clever with Login Forms
#393Earlier quoted context omitted.
Bingo. This is why we went with a stepped process. Did you log in with Google, Twitter, Enterprise SSO, or Email? Do you even have an account, maybe you need to create one? It frustrated everyone. Since we've implemented the stepped process (and made other changes) complaints have all but disappeared, and the number of failed sign in attempts has been significantly reduced, successful logins has increased slightly, a…
Maybe I'm not following things right, but instead of doing it this way, why not have the screen with email and password (and whatever else - forgot password, submit button, etc) - but have the screen do the check on the email - and if the flow is different, change the screen (remove fields, change labels, etc), or redirect to a new screen? That way, those that use password managers could still continue so (as it woul…
Imagine a real world equivalent: a store that loudly states "Membership card needed for purchase", but in actual fact have massive exceptions if you do try and purchase without a membership. This wouldn't be a smart business decision (how many non-members do you know who fill their prescriptions at Costco).
Re: Don’t Get Clever with Login Forms
#394Another rule: make all fields pastable. If you have a form I can't fill in with my password manager, I can copy and paste my username and password with my password manager. Unless... you make those fields so I can't paste into them. Then, I have to open two windows side by side and manually type in my 16 digit password with caps, numbers, and symbols. Tedious.
I use the app keyboard maestro to type out my keyboard contents character by character (although it can do a hell of a lot more than that), which bypasses paste blocking.
Re: Don’t Get Clever with Login Forms
#395My list: 1. Don’t have your website take a longer password than your mobile app and then not let correct passwords login inexplicably 2. Don’t break completely on valid passwords because there’s a char you didn’t expect, testing is a good thing in security critical code. 3. Don’t mess up MFA if you’re a financial app logging into a 3rd party bank for a user by trying to replay a token code 4. If you login to any 3rd…
5. Don't force password rotations. 6. Don't force me to use certain character classes if my password is long enough and therefore entropic enough without them. Special characters suck and are inconsistently supported.
My workaround for #6 is that basically all passwords are auto-generated to include A-Z, a-z, and 0-9. If this doesn't pass character class muster, then I manually append something like "-" to the end of the generated password.
I've already got my entropy needs met in other ways, and "-" is special enough to be considered special, but not special enough to be unsupported.
In other words, sorry for the pun, but I have special token that I use as a token special.
Re: Don’t Get Clever with Login Forms
#396Magic links are a valid method of login that is "right" for many users who end up resetting their accounts anyways. It's better than using true SSO in the sense that "email is decentralized." Yes, that means if their email is compromised the account is compromised, but how many accounts are there are aren't already compromised when using a random password if the email account is insecure? Every story I've heard of an…
I like the magic links, but more as a secondary option or at least an equal option to a password. I have yet to see a site completely depend on the magic links and I hope that doesn't become a thing. I also really like the "go to this website on your computer and enter this code" for logging in to Apple TV, Chromecast, etc so you aren't typing a 30 character password on a TV remote.
>I also really like the "go to this website on your computer and enter this code" for logging in to Apple TV, Chromecast, etc so you aren't typing a 30 character password on a TV remote.
I hate this with a passion. I'm all comfy in my chair, ready to watch something, and I get the message that I have to get up and go to my computer and do stuff when all I want to do is watch TV. So I watch something else that doesn't require a computer to watch on TV.
Re: Don’t Get Clever with Login Forms
#397Earlier quoted context omitted.
I hate password managers with passion. In general passwords are hard to remember. Especially when every site has their own requirements. Password managers add too much friction. I very much like login in with google. Even two factor TOTP is nice. I don’t have to remember things. I just need to carry a device with me.
The trick is to install a password manager browser extension, not to use a password manager that operates as an isolated app / CLI tool / website / etc. Then you unlock it once at the beginning of your session (or whatever frequency you feel like) and it will fill in passwords for you when you click, without having to copy/paste them. It's about as easy as external login / login with Google. (inb4 "but password manag…
Yes but when you’re constantly switching devices and machines. It’s a pain
Most password managers don’t do jack inside a native app (for good security reasons - thank you Apple)
I don’t want to go through 5 mins of clicking and pasting on my phone.
A number of services force you to change passwords every couple of months. They save (may be hash) the old passwords so you can’t use them.
How many goddamn passwords is one supposed to remember?
I care about passwords for important sites and they are all unique. For everything else, it’s yolo!
Re: Don’t Get Clever with Login Forms
#398Earlier quoted context omitted.
Dropbox does an AJAX request when you enter your username, and it's fast enough that when you get to the password field it's already greyed out if you use SSO.
This should be the answer. As soon as the user enters a valid email (regex test) send a request to server to figure out what path they need to go down in the “federated flow”. What we shouldn’t do is diminish the experience for some because the flow for some others is different.
It should be onblur, otherwise you'd send requests for:
- me@example.c
- me@example.co
- me@example.co.
- me@example.co.u
- me@example.co.uk
And you'd have to account for all those tricky race conditions happening there
Re: Don’t Get Clever with Login Forms
#399Another rule: make all fields pastable. If you have a form I can't fill in with my password manager, I can copy and paste my username and password with my password manager. Unless... you make those fields so I can't paste into them. Then, I have to open two windows side by side and manually type in my 16 digit password with caps, numbers, and symbols. Tedious.
I would love Apple to add this to their app review process, as some apps also disable pasting. In addition, force all apps to allow password managers.
Re: Don’t Get Clever with Login Forms
#400Another rule: make all fields pastable. If you have a form I can't fill in with my password manager, I can copy and paste my username and password with my password manager. Unless... you make those fields so I can't paste into them. Then, I have to open two windows side by side and manually type in my 16 digit password with caps, numbers, and symbols. Tedious.
I've never understood this desire to make a web site behave like it isn't a web site. The entire benefit of web sites is that they've got a consistent interface even between web sites. Don't break that! Don't break copy and paste. Don't break the back button. Don't change or break the right click/context menu. Don't hide the toolbars.
> Don't break the back button.
Can someone please tell SAP?