Ask HN: Why split username and password to separate pages? | Hacker News Reader

Ask HN: Why split username and password to separate pages?

7 pointsgxqoz6 comments

More and more I'm seeing login screens where the username is on one page and the password entry is on another screen. The Economist's website was the most recent site to do this.

I can understand why this happens in certain exceptional cases. For instance, Microsoft's account might require you to log in on your organization's own site.

But for most websites, this makes no sense to me. It makes it harder to use a password manager to automatically fill in your credentials. I don't see how this is "less work" at a UX level since you end up having to hit more buttons. Was there some UX memo that this improves conversion that I haven't seen?

View on HN

You're seeing identifier-first authentication, also known as identity discovery.

When you enter your username, the system decides, from some part of it, what possible credential store, out of many, needs to be queried. It may discover that your identity is actually part of some federated SSO protocol, and send you off to be authenticated there, or it might have your ID locally and just ask for a password.

The alternative UX is MUCH worse. Asking the user to pick from a list which of a hundred different federated systems before accepting credentials.

Example: go here and click the Login button. https://www.educause.edu/

I get this, but I refuse to believe that 80% of websites that employ this are actually using this technique.

Believe it. Federated identity is the future. Businesses don't want to spend money and take the risk of having user credentials, so they outsource it. The more companies outsource it to the same place or places, using standard protocols, the more attractive it is for them. It's identity as a service. Think of it as a replacement for the usual three buttons you see, inviting you to login with google, facebook, or twitter.

But now you’re asking my username, which I have no clue of since I used single sign on...

In a word, security.

It is harder for password managers but also harder for password guessers.

Each guess requires additional communication and response from the server. A response delay increases with each incorrect guess. The idea is to help make it infeasible to brute force guess a password even if you know the login ID.

By splitting the ID and password pages, the delay can be off loaded to the client instead of the server. It is an alternative to a captcha test.

I've seen some sites using this pattern in order to blur together the ideas of signing up and signing in. You enter your email address and then you are either presented with your login method (Google / Microsoft / email), or else if you are brand new then you choose a method and go through a sign-up flow.

But there are other reasons too. Google does this, I'm guessing so that users who are tech-challenged can be able to just focus on one question at a time?

And then my bank does this questionable thing where they ask for my email first, then along with the password prompt, they show me a "security image" which is an image I chose when I made my account. I think the idea is that a phishing site would be less likely to know my security image, in which case I might realize something's up.

Reply on news.ycombinator.com