Is asking for password before asking for email/username more secure?

Question

When I - and many others - login on a webpage or someone else, I type: <email or username> [tab] <password> [enter].

In case of making a specific typing error - not pressing [tab], the password is displayed in clear text in the email/username field. This has happened to me a few times, and I think I'm not the first one.

If you would switch the email/username and password fields, this problem wouldn't occur. However, people not noticing the switch may type their password in the username field, which is what you wanted to prevent in the first place. Besides I think the switch can lead to confusion to the user because it 'looks weird'.

My question is, is switching the email/username and password fields worth it?

Answer 1

Answer

People are creatures of habit and have become accustom to the standard login page by now. (i.e., username then password). Changing this flow would undoubtedly create a UX nightmare and may ultimately cause the application it's protecting to receive unfair criticism based solely on the login page.

Alternatives

A better approach would be to not set automatic focus in the username field so that the user has to manually click into the username field, thus increasing his/her awareness of their actions.

Alternatively, if you wanted to do some lightweight testing of your theory, consider setting the focus.onLoad() (I'm pseudo-coding here) to the password field. As a third option, consider hiding the characters of the username as well.

Answer 2

No. This is a terrible idea.

Users won't notice the switch

Study after study has shown that users don't read the text on the page. They rely much more on size, position, proximity, and convention. Users assume that the user ID comes first and the password comes second. If you flip them around, no matter how clearly you label them, they will still put the user name in the first field and the password in the second field, where, because of your idea, it will now be shown in clear text. You've just made the problem worse.

Sometimes user ID has to come first

User ID has to be entered first for some password manager addons to properly choose a password.

Also, user ID sometimes has to be entered first for certain types of anti-phishing mitigation, such as TruStamp or "familiar phrase."

You can't prevent fatfingers

Sure, you addressed one type of typo, but introduced another type of typo problem. What if the user accidentally hits the tab key before entering the password?

No matter what you do, you cannot address all possible typos. At some point you have to trust the user not to be an idiot.

There are better alternatives

If this issue really bothers you, there are a few things you can do.

1. Use an email address as the user ID, and don't permit any data entry after the ".com" or ".org" at the end
2. Put password on a different page
3. Pre-fill the user name (e.g. "Remember me" cookie) and set focus to the password
4. Use multiple factors of authentication, so that the password isn't so important

Answer 3

Everything that goes against an habit, that in this case is type the email before, will be in some way, be forced (by users complaining), to change to the default, most used/common behaviour.

Just make an A/B testing an see the results. People are usually blind to somethings that they see, or are used to see every day. For example if gmail E-mail field, become Email, it will be really hard to someone notice.

IMHO this goes rudely against the usability patterns and could lead to more password leaks than the standard version email/password.

Analyse the error, the missing that error, is a USER ERROR, but if you invert the fields, and the user type his password on email field, even being his error, will be an error that YOU LEAD THE USER TO DO.