4 ms·
If it's done properly, it shouldn't mess with password managers. The trick to doing it properly is to put a hidden password field on the first screen so the pas
by kevsim 6y ago
If it's done properly, it shouldn't mess with password managers. The trick to doing it properly is to put a hidden password field on the first screen so the password manager can still fill it in. If the page sees them both filled in, it knows it's not dealing with a federated identity situation and can just log the user in.
Other services show both the username/password but send requests to the server as the user types their email address and take away the password field if it's an email associated with an SSO domain. I believe this is how Dropbox does it (could be remembering wrong).
- aliswe 6y agoDone properly, are you sure about that? Sounds like a security risk to me...
- kevsim 6y agoHow so?
- aliswe 6y agoIf I put it this way ... Don't you think that a password manager entering your password into a hidden input sounds a little strange?
- kevsim 6y agoNot at all. You're explicitly performing an action with your password manager on a domain you've already decided to trust. Go head and inspect the source for the Google account screen where you put in your email and you'll see a password field a few elements down with the name "hiddenPassword" with "display: none" set on it. This is a well known approach.