halindromeDec 9
Ondřej Surý
Repeat after me: Separating username and password fields on separate (fucking responsive) page WILL NOT INCREASE A FUCKING SECURITY IN ANY WAY! IT WILL JUST MAKE THE PASSWORD MANAGERS TO WORK WORSE AND THUS IT WILL FUCKING DECREASE THE SECURITY!!!
Dec 9 at 8:01amWeb
Show threadMartin Boller     Dec 9
@ondrej Love it <3
Show threadAlix GuillardDec 9
@ondrej apparently it is not because of security but SSO. https://www.smashingmagazine.com/2024/06/2-page-login-pattern-how-fix-it/ Off course you'll find people saying it's more secure, even some saying in increases usability ¯\_(ツ)_/¯
2-Page Login Pattern, And How To Fix It — Smashing Magazine

The 2-page login pattern is becoming pervasive. Here are the reasons behind this design choice and alternative solutions to create a more efficient and user-friendly authentication experience.

Smashing Magazine
Show threadIgnazio PalmisanoDec 10
@aloxe @ondrej like a chainsaw with two blades
Show threadDJGummikuhDec 9
@ondrej also, don't fucking continue with the login process as soon as 6 digits are entered in the 2FA stage (looking at you, Atlassian). I got locked out twice because I had a wrong paste in my clipboard from the password manager and the login window disappeared so fast I couldn't notice that the numbers stayed the same.
I hate that UX is run by fucking morons nowaday almost unanimously across the board 🤬
Show threadCegorachDec 9
@DJGummikuh @ondrej would you like some 1px-and-autohide scrollbars as seasoning for your notion? /S
Show threadStefan EissingDec 9
@ondrej
Show threadTed LemonDec 9
@icing @ondrej This works on so many levels. :)
Show threadJack Yan (甄爵恩)Dec 9
@ondrej Really good to know. As a user, I have always hated the two-page log-in.
Show threadL'égrégore André ꕭꕬDec 9
@ondrej Also, it's an accessibility nightmare (and as such, decrease security even more).
Show threadJames ScholesDec 9
@Mabande @ondrej In what ways is it an accessibility nightmare?
Show threadL'égrégore André ꕭꕬDec 9
@jscholes @ondrej Some of the critique I've seen is that it breaks expected patterns and many implementations of it isn't giving enough feedback as to what's happening.
Show threadMark Wyner Won’t Comply Dec 9
@ondrej there’s a special place in hell for the developers who do this. And they’ll be joined by their friends who disable paste on password inputs.
Show threadJim SpathDec 9
@ondrej corollary: Enter your email *twice*. Because we can't trust users to do it right on the first attempt or something.
Show threadHenrik PauliDec 9
@jspath55 @ondrej I wonder how little that protects against people making a typo... (my gut feeling is that very little)
Show threadBerg am Laimerin (v2)Dec 9

@phl @jspath55 @ondrej

Nearly none, because most people do copy paste?

Show threadTim 🎮Dec 9
@phl @jspath55 @ondrej TBH, as someone who suggested this feature in something I support, watched it get implemented, and saw a whole category of support tickets just cease to be raised anymore - when dealing with the general public, yes, forcing them to enter their email address twice when creating an account does in fact make a difference.
Show threadHenrik PauliDec 9
@timixretroplays @jspath55 @ondrej That is interesting to hear!
Show threadBynkiiDec 9
@timixretroplays @phl @jspath55 @ondrej the amount of emails I get not for me at all tells me you’re right.
Show threadRae PattersonDec 9

@jspath55 @ondrej

The only time I've ever typed my email address wrong on one of the "confirm your email address" pages is when I've made a typo on the second one because I am rolling my eyes too hard.

Show threadsoloDec 10
@jspath55 @ondrej whenever I'm not using a password manager to auto-fill these fields (i.e. it failed for some reason), then I'll just type it once & then copy & paste it for the second one
Show threadWindy cityDec 9
@ondrej people who approve this, who design it, who code it and who boast about it on production software are employed while me who things about ethical UX patterns sit here with no job contemplating life haha
Show threadMichael McWilliamsDec 9
@ondrej Yes, this is almost as bad as preventing me from seeing what I am typing into the password field. I mean I'm at home and all alone in the room... give me an eyeball icon to click on so I can see if I typed my password right.
Show threadLRDec 9
@ondrej maybe the motivation for this is that some users can't even tab between two fields, nor does the site want to teach them to
Show threadGraeme 🏴󠁧󠁢󠁳󠁣󠁴󠁿Dec 9
@ondrej Yep... it's just enshittification.
Show threadlamorakDec 9
@ondrej it's absolutely amazing UX pattern, you just need to Think different™
Show threadRodrigo VallaDec 9
I agree @ondrej. I have problems with the behavior of these sites specially after misspelling my password. One of my homebanking sites go back to username field, one not. So I write my password in the username field! My fault I suppose...
Show threadSvavar the NeurospicyDec 9

@ondrej

O.M.G! I FUCKING HATE THIS SO MUCH!

Show threadJuraj AntasDec 9
@ondrej time to change the bank?
Show threadK4mpfieDec 9
@ondrej @mailbox_org Pls take this to heart! 🙏🙏🙏 Worst feature of the new interface
Show threadlaurenternesDec 9
@ondrej Also, even when PM works, some website needs you to **actually type something in the box**, otherwise the "NEXT" button won't enable.
So, I have to append manually a space and remove it to proceed 🤦
Show threadArtha 🐲🏳️‍⚧️Dec 9

@ondrej I've heard the (security) reason this is done, is to avoid phishing. A legitimate website, knowing your username, can serve a personalized—familiar to the user—password input, with their avatar, name, or a secret third thing like my bank does. A mismatch should alert the user.

On the other hand, it's foolish to assume a malicious party can't easily scrap this from the original webpage.

Show threadÖlbaumDec 9
@samerion Also, I’ve never seen a single web site do what you described.
@ondrej
Show threadElliotDec 9
@ondrej in addition, those login boxes which are pop-outs that disappear the moment you click the password manager button on the input causing you to have to click it open again.
Show threadIan WilliamsonDec 9
@ondrej @mistercharlie Isn’t this done to support identity federation? Enter my work email and it redirects to my work identity tool (Entra, Okta, Google, etc) which logs me straight in with SSO. Enter my personal email and it asks for a passkey that I set up. Enter another email address and it asks for a password and authenticator code. Without knowing the identity first, how should it present the appropriate fields for authentication which that federated identity uses (if any)?
Show threadKagan MacTane (he/him)Dec 9
@tuckerjj @ondrej @mistercharlie Right, that was my understanding of why this is done, too.
Show threadÖlbaumDec 9
@kagan That’s the reason in a tiny minority of cases. For the rest, the reason is superstition: some dickhead at company B saw such a login form by company A, didn’t know why it was done that way, concluded it must be for security reasons, made the team do the same, and told customer service to tell people who complain that it’s for their own safety.
@tuckerjj @ondrej @mistercharlie
Show threadKagan MacTane (he/him)Dec 10
@oscherler @tuckerjj @ondrej @mistercharlie I don't know how we could possibly survey all the sites out there and find out how true this is, but... I find this all too depressingly believable.
Show threadCees-Jan Kiewiet  Dec 10
@oscherler @kagan @tuckerjj @ondrej @mistercharlie and also SSO can be done with an SSO button. Much clearer
Show threadIan WilliamsonDec 10
@wyri @oscherler @kagan @ondrej @mistercharlie A lot of users won’t have a clue what this is. Enter their email address and it’ll pick automatically.
Show threadCees-Jan Kiewiet  Dec 13
@tuckerjj @oscherler @kagan @ondrej @mistercharlie yeah that's fair, also have to say my password manager is getting pretty good at it.
Show threadMichael CookDec 9
@ondrej I would love to know where this stupid idea came from.
Show threadOggieDec 9

@ondrej
I had an SMS authentication code sent to my phone that was like 14 digits recently.

Absolutely baffling design decisions, this stuff.

Show threadmikiDec 9
@ondrej The point here isn't security, the point is that some users aren't using a password at all. If such a username is detected, instead of being redirected to the password page, you're taken straight to Okta / whatever your chosen SSO system is.
Show threadMin Dec 10
@miki @ondrej You can have a "Use SSO" button on your login form without hiding the password field
Show threadmikiDec 10

@minneyar @ondrej That's arguably a worse UX for nontechnical users.

Zoom is like that, and I've had to explain how to use Zoom SSO to people before.

Show threadMin Dec 10
@miki @ondrej Sure, but nothing's perfect and I'd rather have the option that requires explanation for a small number of users over the one that is less convenient and breaks functionality for a majority of users.
Show threadmikiDec 10
@minneyar @ondrej The number of SSO users is not small. For some tools, it's definitely a majority.
Show threadFubaroqueDec 9

@ondrej It also causes me to type my password in the wrong field, readable for all around me, when the username or password is not accepted for some reason.

#ihatethat

Show threadCMDR Yojimbosan 🅅⁂Dec 9
@ondrej One reasonable possibility for the pattern is systems that implement SSO login flows for *some* users, and they don't want an SSO-bound user to spend time worrying about inputting a password that may indeed not exist.
They need to evaluate the username to decide whether to prompt for a password at all.
Which password managers are causing you problems?
Show threadmr64bitDec 9
@yojimbo @ondrej agreed, I'm sure that's why most of them do it.
But I had a professor during college that was absolutely adamant it was to prevent SQLI
Show threadCMDR Yojimbosan 🅅⁂Dec 9
@mr64bit @ondrej I think it's pretty much an established fact that the way to prevent injection attacks is to correctly parse and handle/quote user input to ensure it doesn't get mixed in with the logic/control flow, not to split a form over multiple pages :-)
Perhaps they're also "helping" the AI/LLM people with their injection "problems" :-)
Show threadÖlbaumDec 9
@yojimbo It’s not the password manager that is causing problems, it’s the web site.
@ondrej
Show threadCMDR Yojimbosan 🅅⁂Dec 10
@oscherler @ondrej I'm using Bitwarden and 1Password, and although I've encountered many sites that split the username and password onto separate screens, most of them work just fine. Some of them do cause failures to follow the flow, and I have to select the password from a dropdown, like I do for the password. I see this as a UX fail and agree that's annoying, but I do not directly as a decrease in security. I may have misunderstood something, and I'm happy to be corrected.
Show threadMad AlexDec 9
@ondrej Separating username and password fields on separate (fucking responsive) page WILL NOT INCREASE A FUCKING SECURITY IN ANY WAY! IT WILL JUST MAKE THE PASSWORD MANAGERS TO WORK WORSE AND THUS IT WILL FUCKING DECREASE THE SECURITY!!!
Show threadBilly O'NealDec 9
@ondrej @looopTools *Unless the password is removed completely