56

This question already has an answer here:

Well, I only have two examples, but it seems to be a slowly growing thing.

First, I noticed that hotmail.com/live.com started to do this - ask for the email address on the first screen, and then you have to click 'next' and then enter your password.

... Man, is this annoying! At least trusty gmail knows good UX. A few months later gmail are doing the same thing.

So, I assume there is a security reason for this workflow because it can't be for UX (?)

But what is the reason? Is it to do with tricking bots/making their life more difficult?

marked as duplicate by Serge Ballesta, Community May 30 '17 at 17:14

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

  • 7
    This has been discussed on UX.SE: ux.stackexchange.com/q/56260 – Arminius May 29 '17 at 13:06
  • 2
    what @Arminius wants is to weave a web between related answers, dear Dan.. It is no problem addressing a problem from another prism in here. It is not a duplicate warning. It does not subtract value from your question. But you should tune down the subjectivity in your question. – Mindwin May 29 '17 at 15:18
  • 1
    @Mindwin Feel free to edit it. I'm pretty confident in my assumptive sentence about "can't", though. In what world be it be good UX to make the user have to click once more than otherwise (to security) necessary. – Dan. May 29 '17 at 17:07
  • 1
    Something to consider: I have a work email address that works as a log in for Microsoft. The login page asks for a login and password, but it redirects me as soon as I type the login, because no password is actually necessary (it uses the Windows account or something). In that case, it would be better for meet personally if the password portion was on a different page, and was only shown to people it applied to. – Kat May 30 '17 at 1:58
  • 1
    @muru don't misunderstand me, I still have to go through several screens to log in, which doesn't work half the time, and is overall quite obnoxious. :) I think your case of being directed away from a screen with a password to another screen with a password warrants a change even more so than mine does, though. – Kat May 30 '17 at 3:04
30

Security / Privacy disadvantage

There are security and privacy risks involved with this approach when badly implemented. An attacker could figure out if the email- or login already exists, when not having a default flow. As mentioned @Mario Trucco this can also be done via the registration process.

  1. Security is at risk: Because it becomes easier for an attacker to bruteforce their way into a system. It will make guessing easier if you only need to guess a password, instead of both the username and password.
  2. The privacy of users is under scrutiny. (Other people will know if you are listed at that website.)

Reasons why this is implemented

I found this on the Google documentation:

This new Google account sign-in flow will provide the following advantages:

  1. Preparation for future authentication solutions that complement passwords
  2. A better experience for SAML SSO users, such as university students or corporate users that sign in with a different identity provider than Google

Security Advantage

  1. It may enable more personalized customization options for security such as phrases or images providing more security options (see example below). This would reduce the scope of phishing as the screen generated would be specific to the user and would vary from user to user.
  2. Because users can have different ways of authenticating and the identity of the user is equal to the username this will make it easier server-side to redirect traffic to the users form of authenticating

Example image Example Image -v The users sees 'his/her' personal Image or Sound. If that image does not correspond with the image given at registration. The users knows this is a fake login.

  • 4
    Hi thanks for your answer, but it seems you are providing reasons for NOT using the process described in my question, I.E I agree with you and I don't know the reasons TO use this process, as used by hotmail and gmail. – Dan. May 29 '17 at 13:55
  • 2
    I like that personalised login screen anti-phishing solution, clever. Though tbh I don't think I would notice the lack of personalised image if the bad guy also removed the 'Tip: If this is not your....'. But provides a good answer anyway. I may implement that into my own projects. Thanks for your answer. – Dan. May 29 '17 at 14:24
  • 12
    An attacker can already find out whether an username/email exists trying the registration process – Mario Trucco May 29 '17 at 15:14
  • 3
    What prevents the phishing site from displaying the personalized image? – xehpuk May 29 '17 at 16:52
  • 6
    @Dan. No, you as the victim would enter your username on the phishing site which then could fetch the image from the real server and display it to you. – xehpuk May 29 '17 at 17:43
15

Passwords are not a requirement for authentication in some cases.

The username generally determines how and what authenticates a user; in a federated login the username will identify the Identity Provider that will authenticate the user. That ID provider might use a password but is not required to; many alternate login flows can happen passively or use other information (e.g. smart card or other hardware token, biometrics, etc.)

Capturing a password in these scenarios either leads to the user entering the (sensitive) data twice (since Hotmail/Google don't need that info, the ID provider would have to request it a 2nd time) or entering data that is not needed at all.

  • 4
    I added the qualification because I had a difficult time understanding your point until half-way thru. – schroeder May 29 '17 at 14:40
5

The other answers have hinted at this but not really, I think, clarified the potential security benefits of a two-step login like this.

Doing things this way allow you to separate out the identification and authentication stages of the login process. Say for example you have an application which has multiple levels of user account with different authentication requirements (e.g. some users have 2FA some just have password auth.) or perhaps something like a portal system with different backend user databases.

By taking the username on screen one, you can then present the correct authentication type for that user on screen two. As mentioned by @ludisposed there is a requirement to have a "default" flow for users who don't exist to avoid revealing valid/invalid usernames to someone who trys to guess valid accounts on the system.

3

The primary reason for separating the username/email entry from the password is Federated Authentication. In many modern web applications, the user signon is handled by the user's own organization (your company or school for example). The website you are visiting (known as the Service Provider) will keep a list of the organizations that they have established federated authentication with, and the domain(s) used by those organizations. Once you have provided your email address, the service provider will use the domain name to determine the organization, and send you to that organization's signon system (known as an Identity Provider). You complete the signon at your organization, and then your organization sends you back to the original website, with your identity information in the form of a web cookie most commonly. For more information, I would recommend you research SAML and OpenID Connect, which are the two protocols most commonly used for this.

  • this is covered by other answers – schroeder May 30 '17 at 16:18
  • 1
    Which answer are you referring to? The other answers only seem to discuss federated authentication tangentially, when this is the primary reason for the UI design he is questioning. – Byron Jones May 30 '17 at 17:27
1

Conditionally offering different ways to authenticate

Submitting your username/email address alone allows them to look up your account and check what authentication options they should offer you, based on how your account with them is set up.

For example: whether they should just ask for for a password, or send a single-use code via SMS, or redirect your web browser to a third-party service's authentication page.

  • 2
    this is covered by other answers – schroeder May 30 '17 at 13:32
-5

Its another way to ensure you are committed to visiting the website and signing in. Also its another way to ensure you are not a robot or script. Its also a way to monitor you interaction with the login. It all link to privacy and security

  • 7
    This login process does nothing to ensure you are not a robot or script. Your last line makes no sense in relation to the rest of your answer (you seem to contradict yourself). – schroeder May 29 '17 at 21:07

Not the answer you're looking for? Browse other questions tagged or ask your own question.