Ask Lemmy

A lot of services these days support multiple forms of authentication. Did you sign up with a separate password? Did you use Google or Facebook auth? Is this a corporate account where auth is via their SSO? They don't even know whether they should ask for your password until they know who you are.

Similarly, platforms that default to a massive CREATE AN ACCOUNT box centered on the screen and make you play Where's Fucking Waldo trying to find the size 8 "Log In" hyperlink.

I wouldn't mind the separate pages for username / password if the "remember me on this device" checkbox weren't fucking useless 99% of the time.

I believe it is so they can support various different SSO providers.

Like, oh you're trying to log in as Peter, well you're a member of the Initech domain, which uses the Initrode SSO, so let me redirect you to their SSO login page.

Oh, you're Bill, you just use a password you pleb. Here's your text box.

Nowadays it is possible to set up many services in such a way that you authenticate in a different way from a password, for example with an app on a smartphone. Such services can't ask you for your password until you have told them what account you want to log into because it might turn out you have to give them something other than a password.

I think it's due to single sign on (SSO) or other means of authentication (OAUTH), which is convenient when used.

But I agree, annoying if you use username and password.

yeah i noticed this as well. extremely annoying, i'm sick of UX getting shittier and more annoying for the vague promise of 'security'. having to get my phone out to login to youtube is a fucking downgrade, plain and simple.

It started as defense against credential stuffing and a speed bump against brute force attacks. Not only is it additional loads for a bot to do, but passive captcha can be put between the steps. Now I think its becoming fashionable.

Federation. Your email address could either be local creds, or federated with google, Microsoft, Facebook, Apple, etc.

When you submit your email address, it determines how you will be authenticating when you submit it.

I cant answer about the separation of username/password, but unnecessary animations seem to be a product of the ensh*ttification of the web

There's two reasons I can think of. One is direct resistance by services to password auto-fill during the aughts (it was new and scary) and separating the account field and pass field defeated auto-fill detection at the time. Amazon separated account and password around then and it's been that way since.

The other is your secret picture, a preventative measure against phishing attacks used by banks and other commercial interests, When you create an account, you're asked to select a stock image and a phrase that the site shows you when asking for your password. That way you know it's really the bank's site and not a phishing site.

Right now I think I have only one web account that uses such a protection.

Google does this best. It hides the password field but it can still be picked up by bitwarden and other password managers so will already be auto-filled when you press next.

I still hate that form of login though.

It still gets filled in by all browsers I have. From usability point of view it’s less chance someone press enter after putting in their login name thus leaving the password field empty and getting refused. This will often lead to a disruption friction of their workflow (don’t know the proper English word)

Probably a security measure to slow down brute forcing

I assume it's to prevent some sort of automated process from trying a username and password over and over again, but that seems easy to get around.