There are several login forms (e.g. Google's) on the internet where you first enter your login name and then, once that's submitted, you get to enter your password.
One of the advantages of this is, I suppose, that the server can pull up an image only it knows and display it to the user to help foil simple phishing schemes.
My question is why nobody does it the other way around - first ask for a password and then for the login name.
I can see the obvious answer (that the password might not be unique and therefore the server wouldn't know whose anti-phishing-images to display), but that doesn't convince me. Immediately disabling accounts which share passwords or at least forcing users to change their passwords to a unique string next time they log in might be ways around that and as an aside it would solve the "123456" password phenomenon.
Another issue I can see is that in a phishing scenario where a user enters his password correctly and then notices that the wrong images are displayed to him, he's already given up his password and all that remains for the phisher to do is to identify who this password belongs to.
What I'd like to know is whether the login-then-password sequence is mostly due to convention or user interface considerations or whether there are other security issues with reversing the sequence to ask for the password first (besides the two I've mentioned).