56 ms·
Don’t Get Clever with Login Forms
- colinramsay 8y agoThere's been a recent tendency to split login forms into username/password over two screens as mentioned in this article. It's maddening. Password managers can't deal with this, unsurprisingly. I don't see the benefit this provides for anyone.
- amaccuish 8y agoThat is quite useful however with some federated auth flows, where you just need the email to see where to send them for the actual auth (e.g. Office365 and SAML login), otherwise you'd needlessly be entering your password. I also much prefer it to the previous way e.g. Office365 worked, where once you'd tabbed away from the email box, they'd detect you needed to be redirected and send you off, whilst most people had begun typing their passwords.
- 8ytecoder 8y agoYeah, federated flows were my guess too. However, the password fields could have been present and hidden in the same page supporting both password managers and avoiding a page transition. And also the hundred other sites that don't need federated flows but think they need to copy this feature as well. Together it's annoying to hit password managers twice for every login.
- amaccuish 8y ago> However, the password fields could have been present and hidden in the same page supporting both password managers and avoiding a page transition But then you run the risk of your password of being submitted to the wrong portal no? > And also the hundred other sites that don't need federated flows but think they need to copy this feature as well Very true. It seems to be becoming increasingly prevalent :(
- 8ytecoder 8y agoi) Hidden and ii) Nothing I enter should be submitted anyway in an SSO flow.
- blattimwind 8y agoPage 1: Email/account name, Page 2: Okay, here are some recatpchas, Page 3: Password. Mistyped it? Start back on Page 1 please.
- tomc1985 8y agoPretty sure that is why... you enter your username and it checks to see what authentication flow to use, if it's a password flow then you get a password screen. Pisses me off too
- deleted 8y ago[deleted]
- jrwoodruff 8y agoBingo. This is why we went with a stepped process. Did you log in with Google, Twitter, Enterprise SSO, or Email? Do you even have an account, maybe you need to create one? It frustrated everyone. Since we've implemented the stepped process (and made other changes) complaints have all but disappeared, and the number of failed sign in attempts has been significantly reduced, successful logins has increased slightly, and overall login attempts dropped. It's not perfect, but all indicators are it's better than a screen full of options - it allows us to guide users to the correct action. Sure, it can still be annoying, but less so than what it was.
- StavrosK 8y agoYour comment confuses me, can you clarify? > This is why we went with a stepped process. [..] It frustrated everyone. But then: > Since we've implemented the stepped process (and made other changes) complaints have all but disappeared
- thisacctforreal 8y ago"[..]" was a list of all the problems that frustrated people before the stepped process.
- StavrosK 8y agoOh, I see, thanks. The list sounded to me like a description of the stepped process, so I was confused.
- 8y ago
- chayesfss 8y agoYes, splitting up auth flow allows you to query auth requirements, query apis for risk/security and more
- joshklein 8y agoWhat reasons are there to avoid doing this asynchronously? (Please note that I’m opposed to requiring user agent javascript to access something claiming to be a website, but let’s assume we’re talking about something behaving like a single-page application post-authentication anyway.)
- enlyth 8y agoI'll give my perspective as a web dev, it can be tricky to time the requests and decide when to query the API asynchronously. Consider a user starts typing an email address, when do you send out the first async request to find out what authentication flow is required? On each onChange event, first time the email is valid, would have issues that your email is foo@bar.com, but foo@bar.co is already valid, so you're probably going to debounce the call by a few hundred ms. What if the user makes typos, or if they are typing in the email very slowly, and so on. You might say it doesn't matter, just don't show any UI feedback until its valid, or keep refreshing the current status, but the problem is your control flow is decided by the email that's typed in. You want to redirect certain users to an SSO page, others to type in their passwords, and so on. susan13@domain.com might need a different authentication flow than susan13@domain.co, which are both valid addresses. Another choice is the onBlur event, but this becomes clunky. Think about when it's triggered and how you would incorporate this into a nice UX, I don't think it's possible. The inversion of control, giving the user time to fill the form in, and press an explicit "Ready, I've typed my correct email in, what's next?" button, makes the flow easy to code. I hope this helps.
- Raidion 8y agoThis is so true it hurts. It honestly sounds like a pretty great idea, so I can see why product would be behind it. "We won't have a login experience like other providers, it would be a total $BRAND_EXPERIENCE_HERE" Then you start getting into the weeds and it's really just not possible to do well.
- jakob223 8y agoDropbox does an AJAX request when you enter your username, and it's fast enough that when you get to the password field it's already greyed out if you use SSO.
- khalilravanna 8y agoThis should be the answer. As soon as the user enters a valid email (regex test) send a request to server to figure out what path they need to go down in the “federated flow”. What we shouldn’t do is diminish the experience for some because the flow for some others is different.
- underwater 8y agoYou shouldn't have a giant sign asking people for something they don't have, it's confusing and discourages people from using your product.
- franciscop 8y agoIt should be onblur, otherwise you'd send requests for: - me@example.c - me@example.co - me@example.co. - me@example.co.u - me@example.co.uk And you'd have to account for all those tricky race conditions happening there
- pmontra 8y agoAnd me@example.co could be the email of another user, so you'll never be able to login with yours.
- velobro 8y agoHelpScout's login is anothrt good example! Definitely echoing other's thoughts that it's the correct way to handle it
- jakear 8y agoDropbox manages to provide both fields, but instantly switch the password to be a “sign in with blah blah” when you’ve typed your email and it recognizes it as using a different provider.
- chrisan 8y ago> That is quite useful however with some federated auth flows This can't be a large majority. I only ever hear complaints. Whats wrong with the suggested way (Harvest example) of having both on the same screen and letting the user choose
- WrtCdEvrydy 8y agoTwilio does this and LastPass can work with it if you type your email address in the first screen, it will fill the password.
- tylerrobinson 8y agoI can't argue with the lack of password manager support. But I know where Product is coming from on these approaches. Asking for an email address on its own screen allows the form to check whether you have an existing account or need to set up a new one. You avoid a link that says "Don't have an account, Register Here". Is it worth it? I suppose it's subjective. Maybe the designer thinks that is a good reduction in friction. Probably more compelling is that the form can pick up your email domain and redirect to Single Sign On if the domain is known.
- etxm 8y agoIs there no longer a panic over letting an attacker know that an account does exist? I remember that being a thing for a while, but haven’t built user facing UI systems in a few years.
- nevir 8y agoIt's still a concern, but often forgotten.
- reificator 8y agoI haven't heard an update on that front for many years, so I'd assume it should still be a concern. Many of the same sites that do this will also have a recovery form that refuses to leak information.
- etxm 8y agoThat’s important. I find it funny[1] when you get the “email does not exist” error on a password reset page. [1] by “funny” I mean not funny
- reaperducer 8y agoI wonder if that's a way for spammers to harvest known good e-mail addresses.
- zrail 8y ago1Password handles this just fine. You just have to hit the button twice.
- mbesto 8y agoSure, but it's definitely YMMV.
- numbsafari 8y agoCame here to say the same. This absolutely works with 1Password, even if you have multiple accounts for a single site (eg Google, or multiple test accounts for a site you run). Split logins are very useful for federated auth, as well as for supporting different kinds of multi-factor auth.
- reaperducer 8y ago1Password isn't the only password manager in the world.
- behringer 8y agoSo submit a bug report to your favorite password manager.
- enobrev 8y agoBitwarden and LastPass seem to handle it fine as well in my experience
- dankyung 8y ago1Password X actually handles this without having to hit the button twice.
- jackweirdy 8y agoIf your platform supports 2FA, differing authentication mechanisms, or really anything that can make one accounts login process different to another, splitting it into 2 steps allows you to request the user ID first, then show the appropriate auth form for the second step. I agree you can achieve this by other means, but services may have their own reasons for doing it this way.
- deleted 8y ago[deleted]
- scarface74 8y agoI’m thinking about how sites like the Amazon card payment site works. You enter your username and password, it sends you an MFA text that iOS automatically recognizes and offers to populate in the field.
- usgmr 8y ago>Password managers can't deal with this, unsurprisingly. I use a password manager too and often wonder about this. Does this responsibility fall on the website's designer/developer or the password manager? In one hand, I'd like my password manager to work on every site too but on the other, being a web developer/designer, I don't want another thing to support. We already have browsers and browser versions, and browsers and browser versions in specific platforms to keep track of. Do I want another layer of something to keep track of? (This is totally unrelated but another thing I apply this question to is a page's/websites ability to support reading mode. You have straightforward pages that you can read wholly in something like Firefox's Reader View or Instapeper/Pocket. Then there are those pages that rely too much on some javascript library (sliders, read more, etc.) to display properly that gets broken when seen through reading mode.)
- mikeash 8y agoThinking pragmatically, a password manager can fix this in one spot, while weird web pages will always be around.
- brianpan 8y agoBoth. It's basically an accessibility problem. Should screen readers be able to handle some unusual pages? Yes. Should websites design for accessibility? Yes.
- mnm1 8y agoAs a developer you should support a proper form that works with password managers. Period. Anything else is a failure on the developer's part to create a working login. It's also a massive security hole you've introduced by encouraging people not to use password managers. They will try to remember the password and we all know where that leads to. Sorry, if you think you can develop a login form that doesn't support password managers and call that a decent effort, you're badly mistaken. That's just shit engineering.
- hombre_fatal 8y agoWhy don't you respond to one of the comments that point out sensible reasons why a website might do this instead of using this as an opportunity to suggest that people are just incompetent?
- DannyB2 8y agoNot only, as someone else pointed out, does the 2nd step of the login (eg, password) vary depending on WHO is logging on, it is theoretically possible that there is no 2nd step in some cases. Maybe you have a USB dongle, and after entering your name or email, you are authenticated. Maybe the machine is trusted for any user who logs in, because it has a USB dongle. Or maybe only certain users, but more than one user is trusted associated with that USB dongle. Or maybe if YOUR phone is detectable as near by, then you have no 2nd login step. There are lots of arguments why putting the user ID and password onto a single form is just plain wrong. This isn't the 20th century anymore.
- optimuspaul 8y agomy password manager has no problems with this
- andrewshadura 8y agoThe Firefox’s built in password manager deals with it just fine. No idea how, and no idea why others can’t cope if it can.
- dontbenebby 8y ago>Password managers can't deal with this, unsurprisingly Maybe I'm overly paranoid but I choose to manually copy my passwords out of my manager into the login form. Then again I also use a PW manager that doesn't support cloud storage. (Though you could always throw your DB into Dropbox if you desired)
- jakelazaroff 8y agoWhat's the benefit of doing it that way?
- dontbenebby 8y agoI've seen some CVEs where malicious websites induce your browser to autofill (basically steal passwords). So the intention is that I stop some script from siphoning my passwords. This admittedly opens me up to phishing, but to mitigate I also have containers set up for various facets of my life. (So it's a big red flag if what's supposedly my bank doesn't open in the "bank" container".) Edit: I also value storing the database locally versus "in the cloud"
- wccrawford 8y agoThat's why you should turn off auto-fill.
- saagarjha 8y agoThis is why most password managers no longer autofill without user interaction.
- FabHK 8y agoYour web browser doesn't have any connection to your password manager. Who knows what your web browser is doing, why would you give it any access to your credentials?
- donarb 8y agoThe Safari browser can be linked to the Keychain Manager, both products coming from Apple.
- Scooty 8y agoThe few times I've seen this (Google and Amazon I think), my password manager (Lastpass) has had no problem, but I've run into several sites where simple two input and a button login forms don't autofill correctly. Usually the username field will get cleared when the password gets autofilled, so I have to manually paste the username. I wish password managers would become popular with non-tech people already. I can't wait for a day where there's just a "Sign in manually" link for the few people that manage to remember their 1200 usernames/passwords. Password managers shouldn't need to rely on autofilling inputs at all.
- SlowRobotAhead 8y agoAgreed. I have a handful of split username then password on a new page sites, and LastPass handles those just fine. It doesn’t do well with banks that think they are being clever though.
- swiftcoder 8y agoI'm honestly not sure why the password managers don't offer federated login (with SSO helped out by their browser extension). As a website owner, I'd love to be able to throw a "login with lastpass" link on the sign in page.
- Too 8y agoOpenID provides federated login and is already widely used. It's not frictionless however and didn't really take off as much as people first expected due to usability problems with login-urls as user ids and anonymity to website owners.
- jiveturkey 8y ago1password deals with this just fine.
- blktiger 8y agoMicrosoft does this and the built-in password manager on Safari works with it just fine.
- Semaphor 8y agoWhile it can't handle the email part, at least mine nowadays handles the password field. I use KeePassXC-Browser (connecting to KeePass despite the name) and it recognizes the password field even if I entered the email in an (annoying) extra step.
- varjolintu 8y agoActually it can handle the email part also. You just have to add the site URL to Site Preferences in the extension's settings and enable Username-only detection. It's a necessary extra step so the credentials wouldn't be filled to search fields or to other single input fields. It's quite hard to detect if an input field is actually a username field.
- Semaphor 8y agooh, that's good to know. Thank you, this will make Microsoft logins much more bearable.
- avip 8y agoSecurity.
- TomK32 8y agoBrowserpass doesn't have any problem with those.
- bobbybroadcast 8y agoIt doesn't? Am I confused about something? When I do it I always have to enter the login, then click again and enter the password.
- tylerl 8y agoActually this is necessary in order to support federated auth. Password managers have already figured out how to support this transparently, so it's a non-issue anymore... Including even Chrome's built in manager, which is not exactly cutting edge. If yours can't cope then it's a sign that your software isn't being actively maintained very well.
- icebraining 8y agoYeah, haven't had problems with Firefox's manager either.
- deleted 8y ago[deleted]
- __jal 8y ago1Password has gotten confused a few times for me. (No way I'd ever use Chrome's. Or Apple's, for that matter.) Although now that I think about it, I think not in a while. Still annoys me - a classic example of offloading the costs of technical decisions on the user, even if those costs are "just" mental energy and a page load. At the very least, if you feel you need to do this, make the login pages very, very lightweight. One I log in to daily has huge background images that are utterly, stupidly useless, wasteful, annoying and for some reason uncacheable.
- krferriter 8y agoWhy is it a requirement to have two separate views? Why not just do the check when the user leaves the username textbox. I don't see the reason for the other page to be displayed separately.
- gammateam 8y agoThis was my first thought too I saw it on Expensify yesterday Doesn't this break a best practice? If you input an email address it tells you whethere there IS or ISN'T a user, and if there IS it asks you for their password. I thought the best practice was to make it unclear whether an email or username is in the system, which would make this a huge regression
- hombre_fatal 8y agoIt doesn't change anything. If the email doesn't exist, you can always redirect to the password form. If the user is confused about their credentials, they'll have to use the "I forgot" system in both cases.
- gammateam 8y agoExpensify shows an avatar for the user
- erichurkman 8y ago> I thought the best practice was to make it unclear whether an email or username is in the system It's useless obfuscation. 99% of systems that tell you "if you entered a valid username, we'll email you a password reset link" also don't allow duplicate accounts by email. Try to register a duplicate on their sign up page and they will tell you "this email address is already in use." Useless "security" obfuscation and creates a terrible user experience trying to reset passwords.
- pbreit 8y agoI don't see why password managers can't deal with this. In fact don't most handle it OK?
- 0xfeba 8y agoYeah I can set a delay or custom keypresses, or field IDs in KeyPass. This and OP just have to configure it properly.
- Operyl 8y agoMy password manager can deal with it: Cmd + \, Enter, Cmd + \, Enter. It is a little saddening, perhaps, but to say it’s breaking password managers entirely is a wrong.
- weej 8y agoReally? I don't have that problem with LastPass. It simply inspects the domain in the URL and DOM element name for the given web page. If it's a password field in the form (even if on separate page that's stand alone) maps back to the domain the creds are stored in LastPass it will give me the option to inject the password into the form field.
- peterhunt 8y agoFor good reason. It gives you more flexibility for when to throw login challenges to mitigate credential stuffing attacks.
- manigandham 8y agoChromes built in password manager handles this fine.
- scarface74 8y agoThe built in iOS password manager handles it.
- hnu0847 8y agoKeePass allows you to program a delay between entering the username and password, but I agree having two separate screens is annoying.
- astura 8y agoThe only time I've seen this an issue with LastPass is when the username field is on a different domain than the password field. In this case I'll save the username and password as different password entries. Otherwise it's a non-issue. Great Lakes Credit Union is an example of a site that does this.
- Benjammer 8y agoEnterprise authentication flows for multi-tenant applications with internal users, tenant users, super users, and de-coupling the identity resolution from the authentication resolution and authorization resolution.
- davchana 8y agoGoogle chrome perfectly handles my bank HDFC login, split on two pages.
- sbr464 8y agoOne possible solution is to allow a url or query param to load a full auth form for each supported provider, in addition to the default stepped screen. That would allow a user to bookmark the form relevant to their auth method.
- SomeHacker44 8y agoI never have problems with 1Password and login screens split into two or even 3 screens (for MFA). Just sayin'.
- K0nserv 8y agoProgressive disclosure can be made to work with password managers, notably Apple's Apple ID login page[0] does this while still allowing the password manager to fill both username and passwords in one action. 0: https://appleid.apple.com/ https://appleid.apple.com/
- extra88 8y agoAs does https://accounts.google.com https://accounts.google.com
- cletus 8y agoI would go further than this: don't get clever with logging in. Here's a list of "don't"s: - DON'T arbitrarily restrict my password from being too long - DON'T arbitrarily restrict me from using special characters - DON'T arbitrarily me require to use certain classes of characters (eg 1 uppercase, 1 lowercase and 1 number as a requirement; see https://xkcd.com/936/ https://xkcd.com/936/) - (this is a big one) DON'T TRY AND STOP ME PASTING MY PASSWORD. I can't tell you how infuriating this is. Login forms aren't hard yet the desire to "add value" with little restrictions and tweaks (because security) is maddening.
- toddsiegel 8y agoYour list is more valuable than OP's. I find 1Password is generally good at working with "clever" login forms.
- kileywm 8y agoWhile I agree with your points, wholeheartedly, someone shared this browser add-on/extension with me that has been a lifesaver for overcoming copy/paste blocking. The name is great too. Firefox: https://addons.mozilla.org/en-US/firefox/addon/don-t-fuck-with-paste/ https://addons.mozilla.org/en-US/firefox/addon/don-t-fuck-wi... Chrome: https://chrome.google.com/webstore/detail/dont-fuck-with-paste/nkgllhigpcljnhoakjkgaieabnkmgdkb https://chrome.google.com/webstore/detail/dont-fuck-with-pas...
- cletus 8y agoI use Don't Fuck With Paste. Unfortunately you don't have this level of control with apps. I've seen more than one app where I can't paste in my password. I see absolutely no reason for this.
- Someone1234 8y agoChamberlain who make smart garage doors under their own and the Lifemaster brand fail almost all of these. Here's a gem from their sign up page[0]: <input autocomplete="off" oncopy="return false" onpaste="return false" data-val="true" data-val-length="The Password must be at least 8 characters long." data-val-length-max="100" data-val-length-min="8" data-val-regex="The field Password must match the regular expression '^(?=.{8,})((?=.*\d)(?=.*[a-z])(?=.*[A-Z])|(?=.*\d)(?=.*[a-zA-Z])(?=.*[\W_])|(?=.*[a-z])(?=.*[A-Z])(?=.*[\W_])).*'." data-val-regex-pattern="^(?=.{8,})((?=.*\d)(?=.*[a-z])(?=.*[A-Z])|(?=.*\d)(?=.*[a-zA-Z])(?=.*[\W_])|(?=.*[a-z])(?=.*[A-Z])(?=.*[\W_])).*" data-val-required="The Password field is required." maxlength="128" placeholder="Create Password*" type="password"> Passwords need to be at least 8 characters in length and must contain at least 3 of the following 4 types of characters: uppercase letter, lowercase letter, number or symbol. The blocking of copy/paste in particular was irksome, but the whole thing is almost every bad security practice all rolled into one. [0] https://www.mychamberlain.com/Account/CreateAccount https://www.mychamberlain.com/Account/CreateAccount
- argd678 8y agoMy list: 1. Don’t have your website take a longer password than your mobile app and then not let correct passwords login inexplicably 2. Don’t break completely on valid passwords because there’s a char you didn’t expect, testing is a good thing in security critical code. 3. Don’t mess up MFA if you’re a financial app logging into a 3rd party bank for a user by trying to replay a token code 4. If you login to any 3rd party services on behalf of a user, support a method that doesn’t require asking the users for their password such as OAuth2
- Solvitieg 8y agoMy biggest one is... Requiring users to login with a username or customer id. (instead of email).
- iscrewyou 8y agoYeah, this is the biggest one. I remember Google used to do it too! (Not sure if they still do because I haven't tried it). Google would let you log in into your google account with a yahoo email address (or any email address I presume) as the google id. It threw me for a loop the first couple of times.
- frosted-flakes 8y agoMy username/email address for my Google account is not a GMail address. I don't use GMail, and it would be ridiculous if I was forced to create a GMail address to be able to sign in to YouTube, etc.
- Casseres 8y agoMy biggest (related) one is… In the sign-up process, validate the email (don't trust the user). I get a lot of emails that companies never validated, including for a while, from Wells Fargo.
- wccrawford 8y agoI was getting insurance claim information from a large company in another state for a while. I finally made a big enough stink that they took my email off the account. And yeah, I'm sure it was the real company and not some phishing emails.
- jes 8y agoCould web developers and password manager developers get together and develop a standard web API for authenticating with a website? I want to specify a URL and have my password manager run a behind-the-scenes conversation with the website and, ultimately, drop me into the home page in a logged-in state.
- amaccuish 8y ago> Could web developers and password manager developers get together and develop a standard web API for authenticating with a website? There is, it's called HTTP basic. But I guess you're meaning more form based login? Well most password boxes are fairly obvious from an HTML point of view already.
- koolba 8y agoDitto for a standard API for updates. That way you could have your password manager automatically rotate your password, either on a schedule or in response to a known breach. Hell we should have an API or machine readable stream for breaches too.
- sinistersnare 8y agoThere was this HN post a bit ago: Relevant Link: https://wicg.github.io/change-password-url/index.html https://wicg.github.io/change-password-url/index.html HN comments: https://news.ycombinator.com/item?id=18618193 https://news.ycombinator.com/item?id=18618193
- jes 8y ago
- pjc50 8y agoOne of these days someone will "solve" login and we won't need all this. Today is not that day.
- polynomial 8y agoBased on some really outstanding examples I've seen in the wild, the solution is here, it's just not evenly distributed yet.
- scotchmi_st 8y agoI think this falls under the principle of 'good design is as little design as possible'.
- efficax 8y agoI agree with a lot of this but magic links are great and I love them. Don't take away my magic login emails.
- psychometry 8y agoYou might be the only one...
- thisisweirdok 8y agoThey're not the only one. Don't shame other people for their preferences.
- ivyirwin 8y agoI too like the magic links. I've been an advocate for them in our tech stack ever since the first one I used on Slack. Yes, it's a paradigm shift, but I don't think that's a reason to avoid using it. My team is split on whether or not they are a good thing, but the main reason people usually give against magic links are it's too cumbersome to go find it in your email. Am I the only one who always has email open? From an implementation standpoint has anyone seen a negative consequence of using magic links? I know password resets are always a portion of our customer service handling – is there an equivalent with magic links?
- andy_adams 8y agoFor my mother-in-law who can't keep her single, reused-everywhere password straight, magic links approximate a miracle. I wish Skype used them so we could save 15 minutes every time we want to video call.
- topoftheforts 8y agoI'm surprised to see someone likes them, but after all there must be a reason if they exist. As someone who uses LastPass for pretty much every online form, I deeply hate magic login emails. I'm fine with them existing, as long as you keep the classic email/password option. Something that usually takes me at most 5 seconds (wait for page to load and for LastPass to fill the fields, then click) ends up being a 30+seconds matter. How is this not terrible user experience???
- davidwitt415 8y agoImo one key point is missing: Don't give users the option authenticate via Google or Facebook. While it may be convenient at signup, it creates an unneeded dependency and confusion if you forget how you log into a certain site.
- mises 8y agoLots of dev tools do this with github, too. The idea of a web-wide sso is a bad one.
- AnIdiotOnTheNet 8y agoI don't think that's true, it's just never been implemented in a way that wasn't bad. You could, for instance, let people have a public key to identify themselves. Your browser or other client could automatically submit your chosen key for you (or expose a button for you to submit it), then there's a challenge and response, and you're logged in. Your account details are stored with the public key as the id.
- Ayesh 8y agoMy developer self loves this idea, knowing that my secret key doesn't even leave the computer. My traveler self hates the idea, because I can't read my emails from my friend's phone when my phone is broken during our 6 month trek.
- mises 8y agoMy security self hates this idea, because a single point of failure is not a good design. How would the key be revoked if lost? Replaced? This seems to necessitate a CA-type infrastructure (like TLS certs). Not something I'm comfortable trusting any corporation or government with.
- AnIdiotOnTheNet 8y agoIf the account is that important to your life, then there are probably other identifying information associated with it, credit card numbers, addresses, etc. Do what you do today when identities are stolen: contact the company, prove you are who you say you are, and the'll let you assign a new key to your profile. Otherwise, who cares? Gen a new key and get on with life.
- ocdtrekkie 8y agoSince password managers are terrible, I'm not fond of any of his advice here. Every bit of feedback is regarding supporting password managers. I'll expand a bit more on why they're completely unnecessary here: https://news.ycombinator.com/item?id=19172769 https://news.ycombinator.com/item?id=19172769 but suffice to say, this is a recommendation that is getting really old, really fast, and breaks every well-understood security principle. Single point of failure for your entire online presence is really, really dumb. One-time login codes are, in fact, really the ideal way to handle login, and he's expressly asking you to not for the benefit of a far weaker security method. And in an attempt to emphasize how frustrating it is, he adds a lot of steps that rarely, if ever exist. Usually, you switch the tab to your email which is already open, and click the link, which opens into a tab where you are logged in. Two steps, not eight.
- shereadsthenews 8y agoThis site looks great and loads quickly on mobile and desktop. Makes me so much more inclined to seriously weigh this advice, which seems solid anyway.
- elfakyn 8y agoAlso, for the love of all the gods, don't prohibit pasting in the password field!!
- sonnyblarney 8y agoModality is ok. The reason being, a 'login' is often an interruption to the normal flow of experience. Trying to do 'A' then 'B' - need to login for 'B'. This is why modals exist. The background to the modal gives the context to 'where the login is happening'. If there is no context then it can have it's own screen. The absolute worst is when you're doing a bunch of stuff, you login, and the app does not forward you on to 'that thing' you were trying to do, rather, you just get to the home page after login and have to re-search etc..
- mikewhy 8y agoAgreed. Modality isn't bad. The author's concerns about them can be boiled down to "make sure your login form has a URL".
- CM30 8y agoYeah. Works fine to have a modal based login form for those with JavaScript and a static page version as a non JS/general fallback, and that'd be the best of both worlds.
- guntars 8y agoHere's another one - DON'T disable the submit button if the fields are empty since some native password managers like Chrome iOS will render as if they've filled the fields, but only provide the values on the user's first interaction on the page. A simple form doesn't have an issue with that.
- JeffRosenberg 8y ago> Since password managers are terrible Wait, why are password managers terrible? That's not an opinion I see much, can you explain why you say that?
- astrea 8y agoOpenCollective's method of emailing you a link that sets a 30 day cookie is a pain for me as I have to be logged into my email on another tab and it seems very insecure to me.
- Apylon777 8y agoThe worst offender I have seen in the wild is treasurydirect.gov. The password must be click in on an online keyboard, and they do not allow password managers to enter the passwords. Screenshot here: https://en.m.wikipedia.org/wiki/TreasuryDirect https://en.m.wikipedia.org/wiki/TreasuryDirect
- dave5104 8y agoAnd here I was thinking that sites not allowing copy/paste on password fields was the worst atrocity...
- reaperducer 8y agoCitibank is bad, too. It uses some kind of JS trick to replace usernames and passwords with asterisks, and you end up with all kinds of invalid information stored in your password manager.
- c17r 8y agoI currently use BitWarden (LastPass previously) and neither have had a problem logging into Citi's website though it's been quite some time since I tried to add a new entry from their site.
- IggleSniggle 8y ago+1 for BitWarden. For anyone reading this unfamiliar, it's an open source password manager with all the usual features (including iOS Fingerprint enabled client etc, shared group passwords), but the server is also open-source, and you can host your vault on your own server. It's free for individuals/families, supported by Enterprise licensing (or you can roll your own).
- deleted 8y ago[deleted]
- pc86 8y agoI would think the fix to this would be manually entering the credentials into the password manager rather than having it read the credentials from the site.
- quadrature 8y agoHow do people feel about the passwordless option discussed in the article?. I feel like it can be done smoothly by: - giving the user a link to their email service - providing a link in the email that completes the auth flow, no need to copy paste anything.
- Ajedi32 8y agoWell, for one it's far more secure than password-based logins are. (No need to worry about weak passwords, brute-force attempts, credential stuffing, etc.)
- mpicker0 8y agoHow about username/password fields that actually look like data entry fields? In the Delta example, the "fields" are indicated by a faint grey underline with placeholder prompts nearly as dark as the page text. I've seen this on multiple sites; I guess it's not fashionable to show "ugly" text entry boxes in the UI, but without them, it's hard to immediately recognize where I should click to enter my username.
- analog31 8y agoSomething I've noticed, since I've been living for a few days with "my cell phone is my computer." When a login form appears, my on-screen keyboard pops up and covers half the form. Thus, anything at the bottom of the form is likely to be hidden unless I remember to look there. So a cell phone friendly login form should put the most vital info in the upper half.
- alexashka 8y agoI think the article misses a larger point - why is everyone re-inventing the wheel? We really don't need 'how to create a wheel' tips and tricks - it's a solved problem. We can move on. Can't wait for a sane registration/login cross platform widget to end this madness.
- jillesvangurp 8y agoIt's 2019 and we're still doing email based signups, by default. What's wrong with this industry? OpenId was a pretty neat idea twelve years ago. And given the amount of password databases getting compromised, quite many websites would have been better off federating identity with a competent provider. But no, world plus dog still outsources security to email providers like hotmail, gmail, or worse. Basically compromise somebody's inbox and you gain access to most of what they ever signed up for. Single point of failure, and even if you protect it properly you are still at the mercy of their support not falling for some social engineering attempts. It would be nice if Mozilla followed through with their repeated attempts to integrate authentication in the browser (they've been experimenting with this for most of this decade) and deliver something that 1) works, 2) is stupidly easy to start using for websites, 3) is bleedingly obvious to use for end users. The current implementation of webauthn fails all 3 tests. I've not seen it work once. I rarely encounter websites that support it and it does not work with mainstream hardware like the nano ledger or now very common finger print readers on many laptops. I've had finger print readers on my laptop for ages. I've yet to encounter a website or browser capable of doing anything productive with that. I thought webauthn was supposed to be it but it seems to be out of scope and instead require USB dongles. Even Apple, who apparently love dongles, are not bothering to support that with a dongle or other people's dongles. The first browser to do the bleedingly obvious thing to support built in fingerprint readers in combination with webauthn would instantly incentivize hordes of website developers to start relying on that. So much easier than messing with passwords. Also, MS seems to perpetually get stuck doing proprietary whatever instead of fixing security properly. Apple has been shipping touchid for a few years now. Lenovos came with fingerprint readers last decade already.
- treve 8y agoI also don't understand why Mozilla killed these projects. The original persona (BrowserID) was a pretty solid idea, but I think it's pretty expected for these things to take years of advocacy to pick up. I wonder if it was changed and canned simply because they didn't hit their early metrics.
- WorldMaker 8y ago
- thisisweirdok 8y agoMost of these patterns are fine if implemented correctly. It's not hard to trigger a modal with a URL for example. Password managers work fine with multi-page forms, you just have to label the inputs correctly and the user might have to press a button twice. Magic links are fine, and can even be good if it's you include a log-in link in the email that does the work for you. Certainly better than a weak password (most people don't use password managers). I'd suggest that implementing a magic link for log-in would be superior to all of these recommendations because it's a better layer of security than the _literal nothing_ most people use to secure their accounts.
- mnm1 8y agoAtlassian does this multi page login and it's shit. Google too though as least their shitty implementation works with password managers without having to fill in the info multiple times. There's a simple rule one can follow: if it doesn't work with a password manager, the login is completely broken and your engineers and product team are morons. If it kinda works with a password manager, the above still applies. Login has been a solved problem for awhile so messing with it just shows what little care the website has for its customers and how out of touch it is with them and the rest of the internet. Such websites should be ashamed of themselves for not getting the simplest part right. I'm looking at you jira. After login it just gets worse and worse.
- i_cant_speel 8y agoDon't: Force users to come up with a username separate from their email if they aren't going to be interacting with others under that name. (eg. Hacker News this is OK. Logging into my bank account is not.) Do: If the username is always the users email, call the field "email" and not "username". (Looking at you, ComEd)
- indysigners 8y agoDespite its simple appearance, login forms bring in a bunch of usability failures that so many sites suffer from, actually most of them. Social media login hasn’t necessarily helped matters either. There’s a whole book dedicated to good, simple, mobile input-friendly and accessible forms at https://www.smashingmagazine.com/printed-books/form-design-patterns/ https://www.smashingmagazine.com/printed-books/form-design-p... and it has a whole chapter dedicated to good login forms... sorry for the plug, but I think it’s a really good book — I learned a whole lot while reading it!
- aschampion 8y agoEvernote is guilty of this. They don't create the password field until you've typed in your username, breaking every login manager. This along with their synchronization getting worse over time has effectively caused me to stop using it.
- jessep 8y agoThis seems like brad coming up with a list of things that annoy him, without any data to back it up. I also like using password managers, but all that really matters are the results that services get from different flows. Magic links, for example, have almost certainly been a/b tested by the services using them, and most likely lead to better outcomes. There are a lot of genuine issues with passwords that password managers solve, but I would guess most people still don't use a password manager. For this kind of thing, doing experiments and following the numbers seems like the only way to do it. Why trust your gut when you can so easily get real data?
- RickS 8y agoI think you and Brad are making different arguments. I think you're both right in different ways. You're correct that convenience features like this, despite undermining password managers and interrupting power-user security practices, create positive business outcomes. Ditto for things that win A/B tests. But user experience != business experience. Positive business outcomes don't imply that users are being maximally well served under the winning system. Example: anything by Comcast or Verizon. --- Separately, I believe in the case of Notion specifically, their use of emailed unique strings in place of passwords is a security decision made by them to avoid storing credentials, which they consider riskier than the magic links. While I find this tedious as well, I respect the decision and it's not a frequent PITA.
- nickdandakis 8y agoThe magic link / Notion example is completely lost on me. "The pattern is incredibly tedious" That's the point. You log in to your email to log in to your Notion. It's not 2FA, but maybe there should be some other term for it (like External Factor Authentication). I think unifying all of our logins against our email would be a step forward, not backwards. Then, sure, use your password manager for your email log in. "This doesn’t work at all with password managers" Yes, because there's no password to manage. Even if password managers end up supporting this flow, that'd require email access, and that seems like a Bad Idea™. Funnily enough, I'm sure that if password managers started supporting magic links with email access, UX people would rejoice even though it's a security concern. "It forces users to learn a new convention" Yes, it does. Granted, the Notion flow could be easier by injecting the temporary password into the log in URL, such that the end-user doesn't have to copy and paste it over.
- crazygringo 8y ago> don’t put logins in modals LastPass fills out my username and password on modals just fine. Tested it out on Hertz just now. If other password managers don't... then they should be improved, no? Why should a site bother with a slower page load when an instant modal works just fine, as long as it's properly implemented? > don’t split login across multiple pages I've never seen this done except when it's necessary because depending on the account identifier (username) a different authentication method is used -- e.g. redirecting to your institution's authentication page. Of course if you have a direct account you have no idea and it just seems annoying. But it is a feature, not a bug. I'm not convinced the author has really done their full research here.
- aaronbrethorst 8y agoNot being able to link directly to the login, which can be a pain for customer support people (since they have to give a bunch of instructions described above rather than simply providing a link).
- bwood 8y ago>> don’t split login across multiple pages >I've never seen this done except when it's necessary because depending on the account identifier (username) a different authentication method is used -- e.g. redirecting to your institution's authentication page. I've actually noticed this becoming more common and I find it super annoying when there's no obvious need for it. Even Google does this now: https://i.imgur.com/ZH1yiqH.jpg https://i.imgur.com/ZH1yiqH.jpg
- scarejunba 8y agoThat allows federated login. You can federate Google login to Okta etc.
- Technetium_Hat 8y agoYes, my school used to do this.
- 8y ago
- shapiro92 8y agothe split sign up fields is actually a security design
- edoo 8y agoI was a regular user of Expedia until some genius got the idea to disallow pasting into the password prompt. That was a few years ago and I couldn't tell you to this day if they fixed it or not. It was probably a short lived experiment.
- montagg 8y ago> don’t split login across multiple pages At a company I work with, we found that splitting account creation and login fields across several pages actually simplified the account process for customers and led to increase sign ups and more reliable log-ins. It’s not as efficient for password managers—I use 1Password, too, and it’s a minor friction point for me personally—but for users, we have some evidence it actually increases clarity through focus.
- randlet 8y agoEvery time I logon to the AWS console I curse because the login is split across two pages and I have to select the correct login to autofill from my pwd manager twice.
- RankingMember 8y agoWhile we're on the subject of bad login pages, can we also please stop showing UI elements (e.g. upvote/downvote/flag in comment sections) that jarringly take you to a completely separate login page when clicked (rather than giving you a modal or some other non-jarring login opportunity)? The more egregious ones don't even take you back to where you were after you login.
- 1023bytes 8y agoThe Delta example is not quite the case. It only asks you for the last name if you provide a username instead of their number.
- crossman 8y agoYeah I was looking at that one thinking something was off. I log in to my delta account frequently with a password manager and haven't had an issue. I guess that's why
- voze 8y agoThis article is pretty embarrassing - it misses so much nuance, particularly around multi-step sign in, and magic links. I don't think the author has actually thought through the user need here. A few examples: (1) Multi-step sign in flows – as noted in other comments here – are incredibly useful for any product which supports multiple authentication methods. The email is used to point the user in the right direction, versus putting the cognitive load on them to know their own authentication type, or making them enter their password multiple times. (2) Magic links are incredibly useful in a few places: an example would be something you use infrequently (and thus won't remember your password and/or have a cookie clear between sessions), something where you're typically authed via SSO (same deal – you won't remember your password, etc.), or where you need to sign in via mobile. Mobile sign in, in particular, is really frustrating with special characters. Most users remember that they hit shift+5, they don't remember that that translates to "%". However, they almost ALWAYS have an email client with an active session. Magic link emails are a great way to help that user get into the product with minimal pain. Generally, I'd assume that most companies have put a lot of thought into this (Google, Slack, etc.), and they don't deviate for "fun", they support these patterns because there's an established user need. Source: experience as a PM on sign in flows across a number of products.
- tzs 8y agoOne bit of cleverness I would like to see is allowing username and password to be entered together in the same field. Provide the normal, separate username and password fields, and if both are filled out proceed normally. If, however, the username is blank but the password is not, check to see if the value in the password field contains internal white space. If it does, split it on the first run of internal white space, taking the resulting two strings as the username and password. This allows entering both the username and password with a single paste operation. This would be convenient for people who are managing their passwords via some mechanism that cannot automatically fill out fields in their browser.
- enobrev 8y agoUnless you have spaces in your password
- lucb1e 8y agoThen just split on the first space (I do that a lot with text files that I parse, like `for line in file: date, hours_worked, comment = line.strip().split(' ', 2)`. The real issue starts when you have spaces in your username. We should just use some non-printable, like, I don't know... tab?
- tzs 8y agoIt's only a problem if you have leading spaces in your password. If you want the option of single field login you would have to avoid that. I suppose an interior space in a password also raises the possibility of accidentally logging in as someone else. Suppose your password is "foo bar.spam", and you try to login using the normal two field approach, so you put your username in the username field and "foo bar.spam" is the password field, but somehow botch filling out the username field so it is blank. The system will try the alternative interpretation, that you want to login as user "foo" with password "bar.spam". If there happens to be someone with "foo" as a username who happens to have "bar.spam" as a password, you will end up logged in as them! This could be addressed by requiring some special value in the username field to signal you want to use the one field option. Say, "a" as the username means look for combined username/password in the password field. It's slightly more work for the user as they do have to enter something in username now, but still only needs one copy/paste which is the main point.
- thinkloop 8y agoWhat is the fundamental nature of a login page? Is a login page a first-order feature of a site, a real piece of functionality that should have its own url (aka `/login`)? Or..... Is a login page just one possible state of an actual page? For example, if you have a secret dashboard page at `/secret-dashboard`, and Bob is logged in he would see his dashboard data, while if Suzy was logged in she would see different data for her (different pages). Doesn't it follow that a non-logged-in user would simply be presented their "data", which in this case would be no data at all and a login page instead? All while the url stays at `/secret-dashboard`. This would still allow being able to directly visit a login page (as the article recommends) by simply going to any protected url.
- tylerl 8y agoSplitting username and password across two different steps: Google recently switched to this model/workflow, but for good reason. They introduced support for integration with third-party authentication (using SAML) so that you could authenticate to your Google account using your own company's auth as it's source of truth (AD or Duo or whatever). And since it decides whether or not you need a password based on your username, you can't ask for both at the same time.
- philip1209 8y agoWhat does HN think of Google Invisible Recaptcha on login pages? We have it implemented but have been receiving feedback lately that it doesn't play nicely in many cases (no Google account, private browser windows, privacy plugins, etc). I'm trying to decide whether to remove it.
- TomK32 8y agoI suck a traffic lights so when my bosses wanted recaptchta instead of whatever-the-interesting-offers-spammers-send-through-our-contact-form I also added our office email address to all those contact forms. Personally I rather use the email address than fill in a form.
- 0xCMP 8y agoI really dislike when it's blocked, but I have no idea. Login forms should 100% have an error state shown to the user when the problem is the captcha not loading, being sent, etc. I personally white-list the Recaptcha stuff just because there is a legit security benefit to it and not much else I'm aware of to work as well as it does.
- hombre_fatal 8y agoHN even uses it. It's a decent trade-off. Also, most users will check "remember me" and won't see your login form regularly. I haven't seen HN's login form since I registered two months ago.
- Spectral 8y agoThis list reads like Brad trying to offering semi reasons why XX is bad, but then at the end of each point his real motive comes out which is he's just annoyed his password manager doesn't work smoothly. Some points are valid, but the post just appears very biased.
- deleted 8y ago[deleted]
- astine 8y agoIs there any technical reason that a password manager cannot be made to work with split logins or hidden fields? Shouldn't they have access to the same web browser that user does? I'd think that could be scripted to handle these things. Obviously this makes it more complex for password managers to auto-enter passwords, different websites will have different scripts but I see no reason for this to be an insurmountable issue.
- schroffl 8y agoI made a custom password manager a while back [1] where I used the MutationObserver API [2] to detect when a field is unhidden or newly added. I mainly did it to deal with iClouds login flow. The performance of that could probably be improved by figuring out the container of the login and only attaching the observer to that. But the whole thing was never really finished and I eventually forgot about it. [1] https://github.com/schroffl/browser-password https://github.com/schroffl/browser-password [2] https://developer.mozilla.org/en-US/docs/Web/API/MutationObserver/blob/master/content-scripts/login.js#L11 https://developer.mozilla.org/en-US/docs/Web/API/MutationObs...
- allochthon 8y agoOne thing I ran into recently: a signup form that did not allow pasting a password (one generated by my password manager). It was very annoying to have to type it in manually.
- alanh 8y agoI have seen some sites that only show a username field but nevertheless are compatible with my password manager (1Password). What I suspect is going on is that the password field is present but visually hidden (not missing and probably not with display: none, but perhaps by being placed in an overflow: hidden box with a height of zero or a similar technique). I haven't confirmed this hunch as to the technique but it seems like a good compromise if there is a good reason to hide the password field initially. And I think there are some such good reasons. For example, if you are Google: Not everyone logs in to Google with a password. I have to log in to my work account using our company's SSO provider, so that Google account has no password. In this case, I shouldn't see a password field, as its presence will be more confusing than helpful. Still, a hidden-but-present password field would allow my password manager to work in the case that my Google account does in fact take a password. (Presumably care should be taken to avoid adding extra confusion to users of assistive technology.)
- 0xCMP 8y agoMagic links are a valid method of login that is "right" for many users who end up resetting their accounts anyways. It's better than using true SSO in the sense that "email is decentralized." Yes, that means if their email is compromised the account is compromised, but how many accounts are there are aren't already compromised when using a random password if the email account is insecure? Every story I've heard of an attacker gaining "access to everything" involves attacking the Email account in some way to then password reset everything. You may also complain that Email is literally not secure so the link could be intercepted unless it was PGP encrypted (somehow). I grant that I think this is perfectly legitimate when the user is facing more advanced attackers (possibly those with passive access to traffic or backend access to emails. NSA or Company IT come to mind) and hence maybe the need for U2F or TOTP. We get so many "password reset" emails on our old system that I think it'd just be better if they could login with just an email. Users should use strong and secure methods for their email(s) and websites so err on the side of Magic Links or SSO. Preferably Magic Links because they expose less about the user by default except their email.
- eeeeeeeeeeeee 8y agoI like the magic links, but more as a secondary option or at least an equal option to a password. I have yet to see a site completely depend on the magic links and I hope that doesn't become a thing. I also really like the "go to this website on your computer and enter this code" for logging in to Apple TV, Chromecast, etc so you aren't typing a 30 character password on a TV remote.
- kiliankoe 8y agoNotion uses magic links only for their login and it's aggravating. It may be nice for some users, but using my password manager's autofill is much faster than going to my inbox and clicking a link.
- huy-nguyen 8y agoI think Medium does this too (unless you want to log in with your social account, which I don't like for privacy reason) and it really annoys me.
- cronix 8y agoTLDR: I use some password managers that don't work on websites unless you use the format the particular password manager I chose to use, is using. Therefore, web devs, please adjust your code so that my password manager of choice will work, and keep up with the ever growing list of password managers that have nothing to do with your website. It will make my life easier. Thank you!
- echeese 8y agoAlso, set the autocomplete attribute: https://developer.mozilla.org/en-US/docs/Web/HTML/Attributes/autocomplete https://developer.mozilla.org/en-US/docs/Web/HTML/Attributes...
- blhack 8y agoSince these threads often become: patterns I think are stupid. On the Xbox One (which runs the home theater in our house): it hides the characters of your password, which I think is somewhat silly to begin with, but you type it in with a giant, on screen keyboard!
- exochrono 8y agoAs someone else in the room who doesn't want to see your password, it's a lot easier to avoid seeing all the characters you're typing in than avoid accidentally seeing the password if it's in plaintext on the big screen.
- ianwalter 8y ago"Don’t split login across multiple pages" should be #1. Why is this a thing?!
- nickjj 8y agoMost of his issues with magic links don't exist everywhere. Maybe "Notion's" magic links are bad, but not everyone does that. They're not tedious if you persist the login beyond 1 session. There's also no need for any type of codes. You just receive the email, open it, click the link and then you could be potentially logged in for months or longer (it's up to the site who issues the link). It's one of the easiest and fastest flows you can ask for with technology that works today in all major browsers.
- k_bx 8y ago> You just receive the email, open it, click the link and then you could be potentially logged in for months One caveat is that your ios gmail app opens an internal browser, that has distinct cookies from main one. So there needs to be some clever websocket listener on the "main" browser that would receive a signal that a person signed in. That said, the product I'm building needs users to log in rarely and painlessly, I decided to do: 1. use simple magic code (no magic link, also "please fill your full account info" once logged in, eliminates separate registration) 2. use "sign-in via ..."
- amdelamar 8y agoMagic link emails are terribly slooooow. Waiting for that email takes too long most of the time. I could've already logged in with a password by now, not even using a password manager.
- nickjj 8y ago> Magic link emails are terribly slooooow. Waiting for that email takes too long most of the time. I could've already logged in with a password by now, not even using a password manager. That depends on how it's implemented. It's up to the site owner to dictate the behavior. You can have them login the first time without an email link click and let them know they need to confirm their email after closing this session in order to access the site. This way you can use the site immediately. That is no less secure than most password based sign ups that have no email confirmation.
- seanwilson 8y ago
- joshuaheard 8y agoAnother rule: make all fields pastable. If you have a form I can't fill in with my password manager, I can copy and paste my username and password with my password manager. Unless... you make those fields so I can't paste into them. Then, I have to open two windows side by side and manually type in my 16 digit password with caps, numbers, and symbols. Tedious.
- labster 8y agoIt's easier to just hack the HTML IME. If pasting is blocked in JS, and the site has a (probably ancient) version of jQuery installed, just throw this in the console: $('*').unbind('paste');
- Spoom 8y agoThere are also Chrome extensions that will attempt to remove any such restrictions automatically, like https://chrome.google.com/webstore/detail/dont-fuck-with-paste/nkgllhigpcljnhoakjkgaieabnkmgdkb?hl=en https://chrome.google.com/webstore/detail/dont-fuck-with-pas...
- folkrav 8y agoLooks like it's also available for Firefox https://addons.mozilla.org/en-US/firefox/addon/don-t-fuck-with-paste/ https://addons.mozilla.org/en-US/firefox/addon/don-t-fuck-wi...
- oefrha 8y agoLovely. I wish this were possible for some stupid mobile apps too, which tend to be extremely painful (triply so for ones that clear the password field as soon as I switch to 1Password to read the next five characters).
- danlugo92 8y agoSadly doesn't work with one of my banks (it detects the ctrl key on keydown)
- monkpit 8y ago> I think this may have started with Slack, but I’m seeing other digital products [...] send users a temporary password to their email in order to login Pretty sure that’s about as old as time itself, I don’t think it was invented by Slack
- lamby 8y agoPerhaps being predictable is most of it, UX wise.
- grdeken 8y agoJust build your login form like this. https://my.spark.app/login https://my.spark.app/login
- mLuby 8y agoI just want to call out Mullvad VPN (in a good way) for only having one field, a super long account number, that acts as both username and password. Extra simple and extra private!
- sergiotapia 8y agoI stopped using Notion because of the email login thing. It got too annoying every time and slowly eroded my love of the product.
- kissgyorgy 8y ago> But it’s not just about creating consistency within your own ecosystem, it’s about being consistent with the rest of the internet. FINALLY someone understands how important this is!!! Great article!
- geekrax 8y agoThe login form on TreasuryDirect is cancer. - They split the form into two parts: Username/Account-Number and Password. - The Username field disables autofill. - The password field on the next page has a virtual keyboard. No autofill, the field is readonly. I have been using this bookmarklet to "fix" these fields and let the password manager work on these fields: javascript:document.querySelector("input[autocomplete='off']").removeAttribute('autocomplete');document.querySelector("input[readonly]").removeAttribute('readonly');
- rblatz 8y agoI came here to specifically complain about TreasuryDirect. Thanks for the bookmark fix. I've just been going in to devtools and manually deleting the readonly. This will save me time and frustration.
- clintonb 8y agoNice! I also wrote a script, but yours is much safer. ``` var s = 'PASSWORD'; for ( var i = 0; i < s.length; i++ ) { PasswordVK(s.charAt(i)); } ```
- rcfox 8y agoMy company is planning to roll out a new login form with a "don't remember me" checkbox. The guy who implemented is standing by it because that's what the mockup showed, and the designer essentially covers his ears and shouts LA LA LA LA when you try to address it with him. So yeah, I expect some fun comments when that eventually rolls out.
- pizza 8y agoMaybe you should (delete your comment and then) send them this thread
- bduerst 8y agoThis default is only going to create security risks as users login on public-facing devices, like a library or device they don't own. I hope you don't make PII or transactions available inside your app, otherwise I would urge escalating this issue internally.
- Scooty 8y agoI'm probably in the minority, but I just expect web sessions to persist regardless of what checkboxes I check. If I have to login to anything on a computer that isn't mine, I just open a private session (usually incognito in Chrome).
- CM30 8y agoHere's another one: Don't do what some banks do when they separate the password field into multiple boxes for various characters in your password. It's enough of a hassle trying to remember the password sometimes, let alone when you've got to randomly work out what the 3rd, 7th, 10th and 15th characters of it are too. They also do this for the pin number too, which is obviously much easier to figure out but again adds unneeded stress for little extra security.
- eridius 8y agoProgressive disclosure works with password managers as long as the hidden fields are still in the DOM and are simply rendered invisible to the user. For example, Apple's login forms work this way where they don't show the password until you've entered your Apple ID, but it still works just fine with 1Password (and with Safari's built-in password manager).
- fudged71 8y agoNow do one of these for Captive Portal WiFi please!!
- taylortrusty 8y agoThe reason the Delta interface hides the last name field is it's only necessary when entering a username. If you enter a Skymiles account # and password, you're not prompted for a last name (or at least I'm not).
- wishinghand 8y agoTumblr and iCloud also split up username and password onto separate pages.
- cjohansson 8y agoGoogle has probably the most tedious logins of all services, with multiple pages and maneuvers you need to do to login with another account without automatically linking the accounts. Often it’s just easier to clear all google cookies than try using the login interface
- 013a 8y ago> don’t split login across multiple pages This is often necessary for enterprise applications; what they're often doing is making an intermediate request once they have your email address to determine how you log in. Do you use a password? Do you use SSO? If you use SSO, is it SAML? Do you have multiple accounts? Here's my experience, as an engineer at an enterprise company. We tried to put everything on one page, and that included an SSO button for every type of SSO provider. Users UNIVERSALLY hated it. They didn't create their account; their company did, who purchased our product. They don't know whether they should log in with Email, Password, SSO, hell: Most of them didn't even know what SSO is or what Provider they use. They see a Google button and they click it, then try to log in with their personal Google account; their company doesn't use G-Suite, they use Office 365, we reject the login because they don't have an account, we get a support ticket. Its absolutely hilarious to me that all of these Suggestions are motivated by the use of password managers. The number of people using password managers is literally a rounding error.
- argd678 8y agoThere needs to be a standard or something here to facilitate password mangers. Everyone should be using one and not reusing the same password.
- nojvek 8y agoI hate password managers with passion. In general passwords are hard to remember. Especially when every site has their own requirements. Password managers add too much friction. I very much like login in with google. Even two factor TOTP is nice. I don’t have to remember things. I just need to carry a device with me.
- beaconstudios 8y agohalf the point of a password manager is to generate passwords so you don't have to think of (or repeat) them and the other half is to store them so you don't have to remember them. I'm not sure where the friction is coming from? In my experience they're easier than remembering a user/password combo by a long shot.
- Imburr 8y agoI contacted notion about their lack of passwords and having to use the login link every time. It is inconvenient when you work as an IT field agent and you're all over the place on different networks and devices needed to look up IP addresses or passwords. they did reply that the reason they did it was security so that they didn't have to store passwords and worried about data breaches, which I can appreciate.
- StreamBright 8y ago> don’t get funky with magic links I am not sure why he brought up this. Magic links the single best option that could have happened with website logins in the last while. I have extremely well guarded email setup with MFA (app based not SMS based) and any suspicious login gets flagged immediately. How many websites can do the same? I appreciate sites who allow me to identify myself with my email without using a password. It is one step froward for a better web.
- soheil 8y agoPretty obvious stuff what's not obvious is the attention it got on here, I'm not hating just making an observation.
- neltnerb 8y agoI think I'd settle for not using javascript to actively block autofilling passwords! I've actually encountered this with the washington post and it was just amazing that they took active measures to break my ability to log in with a password manager. They did fix it after I complained a bunch though! I see the point of some other posters about enterprise systems, but I would be thrilled beyond belief if simple websites with simple login flows who and aren't offering complex services, at the least, keep things simple. I shouldn't need to spend minutes of active attention to log in to a news website. (but kudos to the washingtonpost for eventually getting my point)
- abalone 8y agoHere's another don't: Don't block pasting passwords!! Amazingly there are some sites that do this. I never understood the theory behind it.
- g4k 8y agoShopify started not just splitting the login, but also redirecting to another domain for the password entry. This leads to the situation, that the password manager can not find the correct password anymore as the login domain is not visible during password entry.
- sircastor 8y agoI keep running into the hidden fields mentioned in this article. I'm also maddened by Evernote, which has a login link on it's home page that's only visible to the desktop. If the window is too narrow, is a phone/tablet interface and the only link for login is at the bottom of a clickable menu.
- sfopdxnonstop 8y agoYes, in that case ok. All others, no.
- epynonymous 8y agoregarding his point about separating the login process in multiple pages, not only does spotify do this, google, outlook, they all do this, i think it’s because there’s enterprise custom single sign on which requires a different flow, so they commonize the parts from enterprise and consumer. i’m not saying that i think this is a good workflow or not, just saying that there’s reason to it. and it probably breaks password managers, but for enterprise, there are a lot of different password managers like vmware workspace one, etc which may be different from 1password
- deleted 8y ago[deleted]
- gwbas1c 8y agoEntering an email address first, and then the password, is needed for systems that support SSO. If you're dealing with enterprise users, supporting SSO is the most important thing you can do to keep logins quick and seamless.
- catchmeifyoucan 8y ago1 more pain point...I almost always forget my "special" username, so login forms that have the email as the username are my preference
- ncmncm 8y agoIn Wales, they'd say "Don't Tit About with Login Forms". Seems like a thing to print on T-shirts and hand out at trade shows.
- known 8y agoHow to create a responsive login form with CSS https://www.w3schools.com/howto/howto_css_login_form.asp https://www.w3schools.com/howto/howto_css_login_form.asp
- ronreiter 8y agoThe reason password entry is sometimes split to two forms is because of SSO logins. The alternative is what Microsoft does which is to dynamically check the email after filling it and passing on to the password field and quickly redirecting if needed which is also weird. That’s also why Google does it.
- dustinmoris 8y agoI agree with the many points but it's worth noting that login forms are made for humans to identify themselves with a service and all his suggestions are designed to make it as easy as possible for a bot/machine to identify as the human. There is always another side to the story and whilst password managers are one type of machine for which this becomes useful, it's not the only one.
- alkonaut 8y agoI think the Delta example looks pretty ok. If the user enters a number in a field a second field isn’t required. Then it shouldn’t be visible and enabled until we know that it’s needed. We don’t make a worse UX for humans to make a better “api” for scripts. There must be a way of satisfying both here without being worse for humans. If not: optimize for humans.
- philliphaydon 8y ago“Don’t hide fields” this is a honeypot. Not a required field...
- joduplessis 8y agoMust be those blasted full-stack developers at it again.
- Al-Khwarizmi 8y agoTip from a non-native English speaker: if you want your website to be more friendly to an international audience, don't use the terms "sign in" and "sign up", use more distinct terms (like "login" and "register") instead. Phrasal verbs, in general, are difficult to speakers of languages that don't have them, especially when the same verb has different meanings depending on the added preposition. Someone with a basic/intermediate level of English may have difficulty telling between "sign in" and "sign up". In my own case, I have a good level of English so I know what they mean, but "sign in" and "sign up" always take 2 or 3 seconds for me to disambiguate, while "login" and "register" (or similar) are instantaneuous.
- muzani 8y ago"Sign up" translates to "enter your signature" on Google translate in some languages. Whereas register and log in seem officially supported in many languages.
- chrisseaton 8y agoBut log in is also a phrasal verb...
- gumoro 8y agowhich is close enough to "login", which is widely understood (I do have the same issue with "sign in" VS "sign up", I know the difference, but as a non-native speaker it also takes me a second, or sometimes one is more prominent than the other and I mistakenly click on it, etc). But whatever, ("Sign in" or "Log in") alongside "Register" is clear enough. "Sign in" alongside "Sign up" is confusing. Thanks Al-Khwarizmi for bringing that up... or is it bring in ? ;)
- dsego 8y agoAfaik, you "sign up" for something, like a newsletter, or health insurance. You sign into a hotel, ie leave your signature at the check-in (or sign-in) desk. Btw, also not a native speaker.
- 8y ago
- Jefff8 8y agoI disagree a bit with the article. The premise is that you shouldn't make login forms behave badly for password managers, and I agree with this. But at the same time, people using password managers are not necessarily the major use case for a site or some software. You should make it easiest for the largest number of people you can, and that might mean decluttering the UI and co-incidentally making it harder for password managers.
- firexcy 8y agoCan anyone explain to me the rationale for the recent trend to split the input of username and password into two steps? I noticed more and more services (including Outlook, iCloud, Evernote, etc.) have adopted such an annoying design, which makes no sense to me. I guess the purpose for doing so is to preempt user from typing a wrong/non-exist username so that server resources for checking unmatched credentials are saved and brutal force attacks are prevented? But do they justify all the hassle caused to daily users?
- Grue3 8y agotumblr.com manages to hit 3 don'ts out of 4: modal login window, magic links and multi-stage login where you have to enter your username first, then password on another page. It's extremely painful.
- rubenswieringa 8y agoPoint well made for 99% of the cases. Years back though, I worked on a web application for the elderly – try not getting clever with login forms to a userbase that doesn’t know the difference between logging in and signing up. There are definitely situations where it’s merited to (try to) overcome a lack of tech-savviness with unconventional UIs.
- practicallyou 8y agolevitate people