3 ms·

I hate log in pages which split username and password across two pages. It messes with my password manager.

by pydry 3y ago

samcat116 3y ago
It’s necessary for SSO and passwordless flows
danpalmer 3y ago
As passwords are used less and less with alternatives like Passkeys, SSO, or even just policies defined by the maintainer of an account, split login flows like this are going to become more and more common. I know it’s a slight regression for password managers, it annoyed me at first, but I have made my peace with it as I understand the other security benefits. I’d recommend sorting your password manager out, I use 1Password and don’t have any problems. I think it’s something password managers will need to get better at quickly.
dns_snek 3y ago
Bitwarden usually fills in both fields for me.
frereubu 3y ago
Which password manager do you use? I use 1Password and the split username / password Google logins work fine for me, and from another sibling comment it sounds like Bitwarden does too.
kristjansson 3y ago
AFAICT the better ones (including Google's existing flow) have the password input present in the document, but hidden, and unhide when they want to ask for it. That way a manager looking at the DOM can pre-fill (or be ready to fill) the password. Splitting across two documents seems monstrous and probably insecure?
dbbk 3y ago
It shouldn't if implemented correctly
crazygringo 3y ago
Yeah but it's required for SSO. There's no point in blaming the pages -- blame lies with the password manager or browser/OS. E.g. on iOS, Safari fills in your username just fine even when there's no password field. Whereas on iOS, third-party browsers (e.g. Chrome) won't. According to 1Password, it's a known bug that is up to Apple to support/fix in WebView. (And the fact that it works in Safari but not WebView seems a little anticompetitive...)

3 ms·

I hate log in pages which split username and password across two pages. It messes with my password manager.

by pydry 3y ago

I hate log in pages which split username and password across two pages. It messes with my password manager.

samcat116 3y ago
It’s necessary for SSO and passwordless flows
danpalmer 3y ago
As passwords are used less and less with alternatives like Passkeys, SSO, or even just policies defined by the maintainer of an account, split login flows like this are going to become more and more common. I know it’s a slight regression for password managers, it annoyed me at first, but I have made my peace with it as I understand the other security benefits. I’d recommend sorting your password manager out, I use 1Password and don’t have any problems. I think it’s something password managers will need to get better at quickly.
dns_snek 3y ago
Bitwarden usually fills in both fields for me.
frereubu 3y ago
Which password manager do you use? I use 1Password and the split username / password Google logins work fine for me, and from another sibling comment it sounds like Bitwarden does too.
kristjansson 3y ago
AFAICT the better ones (including Google's existing flow) have the password input present in the document, but hidden, and unhide when they want to ask for it. That way a manager looking at the DOM can pre-fill (or be ready to fill) the password. Splitting across two documents seems monstrous and probably insecure?
dbbk 3y ago
It shouldn't if implemented correctly
crazygringo 3y ago
Yeah but it's required for SSO. There's no point in blaming the pages -- blame lies with the password manager or browser/OS. E.g. on iOS, Safari fills in your username just fine even when there's no password field. Whereas on iOS, third-party browsers (e.g. Chrome) won't. According to 1Password, it's a known bug that is up to Apple to support/fix in WebView. (And the fact that it works in Safari but not WebView seems a little anticompetitive...)