I am noticing a trend in web development where login screens are no longer showing both the username and the password input fields simultaneously. Instead, you are required to type in your username then click a "next" button which will then reveal the password input field. Why is this?
From my experience, I noticed this started a while ago with Yahoo, at least a couple years ago I think, and Gmail too. And now, Apple has followed suit on most of their websites such as iCloud.com, iTunes Connect, and the Apple ID website. However, unlike Gmail, Apple does not check if you have an account before revealing the password field. It literally just unhides the password field.
It appears to be for security purposes, but I am not seeing how. It is interesting that some web developers were attempting to steal credentials recently. On page load Apple's password management solution would autofill credentials, possibly revealing credentials to nefarious websites (or even if not nefarious it still provided user information without explicit consent). This was just recently addressed by no longer autofilling on page load, instead the user must invoke the autofill after clicking into the field. I believe not long after that was addressed, that's when Apple updated their login screens to hide the password input field, which may not be a coincidence. Notably, their implementation breaks autofill of both username and password - on their sites you now have to select the username field, invoke autofill, click the next button, select the password field, invoke autofill, and click the next button to log in - it does not fill in the username and password field upon the first invocation because the password field is not shown until after the username is filled and committed.
Does hiding the password field until the username is committed increase security, and if so, how?