Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I have noticed many website going to a two-page (not two-factor) login system - where you enter your username on page 1 and click submit, and then enter your password on page two and click submit.

What are the benefits to doing this vs having username and password on one page and clicking submit? Is it only to avoid passwords from accidentally being put into the username field?

share|improve this question

2 Answers 2

I've seen this used in systems like SiteKey that some banks use on websites. The idea here is that once the user has identified themselves on page one by entering a username, the application the provides some information (in the case of SiteKey a picture and phrase chosen by the user during enrollment), which is intended to assure the user that they are on the correct site before they enter their password.

Whether this has actual security benefits against standard attackers is debatable (i.e. it could be possible for attackers to act as a Man-in-the-middle and relay the username on to the site, retrieve the image and show this to the user)

share|improve this answer

From a pure functional perspective, the 2 page system sometimes allows for home realm discovery (where the user has accounts in more than one system)

For example, Microsoft has something called the Microsoft Account and the Organizational Account. The username feature allows HRD to redirect to the correct authenticating server. This feature is live and active for all Azure, O365, and related sites.

For clarification:

  • LiveID, or Passport is now known as the Microsoft Account

  • Azure Active Directory, Office 365, WAAD, and possibly ADFS all use "Organizational Accounts"

It is possible to have an account in the form of user@company.com at one or both directories. You can test for the presence of an account in one or the other directory by checking the JSON available here

 https://login.microsoftonline.com/GetUserRealmExtended.srf?login=EMAIL@COMPANY.com 

or

 http://odc.officeapps.live.com/odc/emailhrd/getidp?hm=0&emailAddress=USER%COMPANY.com
share|improve this answer
    
I've seen that with Office 365 myself. What about when it's the same server/service - eg a bank? –  warren Mar 10 at 18:45
    
@Warren, yes that's probably Sitekey. Read about it here security.stackexchange.com/q/26347/396 –  makerofthings7 Mar 10 at 18:48
    
I've seen the SiteKey as well as what appears to merely be a "poor man's SiteKey", where it's just the two fields separated onto different forms/pages –  warren Mar 10 at 18:50

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.