Why do some sites ask for username/email and password on two separate screens? [duplicate]

Question

Well, I only have two examples, but it seems to be a slowly growing thing.

First, I noticed that hotmail.com/live.com started to do this - ask for the email address on the first screen, and then you have to click 'next' and then enter your password.

... Man, is this annoying! At least trusty gmail knows good UX. A few months later gmail are doing the same thing.

So, I assume there is a security reason for this workflow because it can't be for UX (?)

But what is the reason? Is it to do with tricking bots/making their life more difficult?

Answer 1

Security / Privacy disadvantage

There are security and privacy risks involved with this approach when badly implemented. An attacker could figure out if the email- or login already exists, when not having a default flow. As mentioned @Mario Trucco this can also be done via the registration process.

1. Security is at risk: Because it becomes easier for an attacker to bruteforce their way into a system. It will make guessing easier if you only need to guess a password, instead of both the username and password.
2. The privacy of users is under scrutiny. (Other people will know if you are listed at that website.)

Reasons why this is implemented

I found this on the Google documentation:

This new Google account sign-in flow will provide the following advantages:

1. Preparation for future authentication solutions that complement passwords
2. A better experience for SAML SSO users, such as university students or corporate users that sign in with a different identity provider than Google

Security Advantage

1. It may enable more personalized customization options for security such as phrases or images providing more security options (see example below). This would reduce the scope of phishing as the screen generated would be specific to the user and would vary from user to user.
2. Because users can have different ways of authenticating and the identity of the user is equal to the username this will make it easier server-side to redirect traffic to the users form of authenticating

Example image -v The users sees 'his/her' personal Image or Sound. If that image does not correspond with the image given at registration. The users knows this is a fake login.

Answer 2

Passwords are not a requirement for authentication in some cases.

The username generally determines how and what authenticates a user; in a federated login the username will identify the Identity Provider that will authenticate the user. That ID provider might use a password but is not required to; many alternate login flows can happen passively or use other information (e.g. smart card or other hardware token, biometrics, etc.)

Capturing a password in these scenarios either leads to the user entering the (sensitive) data twice (since Hotmail/Google don't need that info, the ID provider would have to request it a 2nd time) or entering data that is not needed at all.

Answer 3

The other answers have hinted at this but not really, I think, clarified the potential security benefits of a two-step login like this.

Doing things this way allow you to separate out the identification and authentication stages of the login process. Say for example you have an application which has multiple levels of user account with different authentication requirements (e.g. some users have 2FA some just have password auth.) or perhaps something like a portal system with different backend user databases.

By taking the username on screen one, you can then present the correct authentication type for that user on screen two. As mentioned by @ludisposed there is a requirement to have a "default" flow for users who don't exist to avoid revealing valid/invalid usernames to someone who trys to guess valid accounts on the system.

Answer 4

The primary reason for separating the username/email entry from the password is Federated Authentication. In many modern web applications, the user signon is handled by the user's own organization (your company or school for example). The website you are visiting (known as the Service Provider) will keep a list of the organizations that they have established federated authentication with, and the domain(s) used by those organizations. Once you have provided your email address, the service provider will use the domain name to determine the organization, and send you to that organization's signon system (known as an Identity Provider). You complete the signon at your organization, and then your organization sends you back to the original website, with your identity information in the form of a web cookie most commonly. For more information, I would recommend you research SAML and OpenID Connect, which are the two protocols most commonly used for this.

Answer 5

Conditionally offering different ways to authenticate

Submitting your username/email address alone allows them to look up your account and check what authentication options they should offer you, based on how your account with them is set up.

For example: whether they should just ask for for a password, or send a single-use code via SMS, or redirect your web browser to a third-party service's authentication page.

Answer 6

Its another way to ensure you are committed to visiting the website and signing in. Also its another way to ensure you are not a robot or script. Its also a way to monitor you interaction with the login. It all link to privacy and security