5 ms·

What are people’s thoughts on the UIX of a sign in page initially with only a single username input? In my view, it is a backwards step. First, I can’t do user

• Bilal_io 2y ago
  I hate that with passion. Though I don't know the technical reason behind this workflow.
  • RexM 2y ago
    I think it’s so it can look at the login method for the account and act accordingly. If the user is configured to use SSO it can redirect to the identity provider. If it’s password auth it can ask for the password, etc.
    • silon42 2y ago
      Isn't that a security leak? Revealing what auth method the user is using.
      • vladvasiliu 2y ago
        I'm not sure always presenting the password field avoids that. If you type in bob@sso.com for your SSO account, the password field will clearly be a throwaway, and you'll be redirected to your IDP. Being presented with a "wrong password" error would mean the account is local.
        • labcomputer 2y ago
          Weeellll… you’d hope so, but some users may try to autofill a password with the right username, which will inadvertently fill the password too. And now your vendor (Quip or whomever) can potentially see your employee’s passwords. You have to trust them to throw away any password they see for someone from your org.
          • vladvasiliu 2y ago
            Oh yeah, I'm pretty sure Atlassian used to that, too. So I can understand the reason of "making it easier for users" invoked by people implementing this "two step" login. But I'd argue this is a different issue than the one of giving out what kind of authentication a given login has.
      • dijit 2y ago
        it would be a larger security issue if they didn’t redirect to the SSO provider and instead threw up a page asking for a password. In many cases SSO means once you’re logged in then you don’t enter a password again for the session anyway- that only works with a redirect. and your login might not even be a password anyway, or require more information than just a password (like MFA)- our solution for example takes into consideration what you’re logging in to, what device you have and where you are to determine the secrecy level of the thing you’re authenticating into. Can’t do that without control.
      • labcomputer 2y ago
        1. It’s usually for institutions. If my email address is username@bigco.com, an attacker already knows that I use BigCo Inc’s internal SSO. 2. It’s avoids having users type (or autofill) their passwords, so if one of (for example) BigCo’s vendors is compromised, the attackers don’t learn the passwords of BigCo employees.
• fastball 2y ago
  Most sites that implement it this way do indeed have something similar to what you describe for Microsoft. e.g. many sites these days allow for "magic link" login where you just enter your email and they send a link to login. There is no password to login with. The problem from there is that users are dumb. If you have multiple login methods, many users will not remember which method they used to login last time. So if you show them (by default) a username/password form, they will try to "remember" a password that might not exist if they used any method that was not username/password. Much better for that user if you make them enter their email, you do a quick lookup in the backend to determine which method they used to login last time, then you proceed with that method in the frontend.
• nmjenkins 2y ago
  (Chief Product Officer at Fastmail here.) Once your next step is not necessarily a password, having just the single username input up front becomes necessary to avoid confusion. To support non-resident passkeys (passkeys on devices that can't store the username with the cryptographic key), we need to be able to prompt for the username, then offer them their passkeys to log in. This does have the effect of making it slightly less ergonomic for just username/password input, but we did everything we could to mitigate this: > First, I can’t do username <tab> password <enter>. True, but we made it so you can do username <enter> password <enter>. > Secondly, with auto fill, it requires two clicks to sign in. True, but the way we've set it up should ensure the autofill did both immediately, so you don't have to activate your password manager twice. The flip side is if you do use passkeys, it can be much quicker than any username/password input. For example, 1Password will show you your list of accounts as soon as the login page loads, and it's just one click to sign in.
  • 0cf8612b2e1e 2y ago
    Sorry to corner you here on unrelated topic, but I will take a chance on asking… Why can I not pre pay my FastMail account? I have a three year subscription which ends in another 14 months. The UI indicates I will be auto renewed two days before my subscription ends. That is not a comforting margin for error in the event there is a billing issue for something as vital as email. I can understand you do not want to let people pre-purchase infinite time, but you already offer the three year plan. Let me top it off well in advance of the expiration date, so I have ample time to resolve issues if they occur. Let me subscribe to an annual renewal, always maintaining a two year balance. Coincidentally, checking my account now, I see my credit card on file is expired.
    • slau 2y ago
      IIRC, when my payment lapsed due to an expired card, I got plenty of time to fix the issue. In my case, the payment is taken from the card a whole month and a half before the invoice is generated (typically a different fiscal year, smh).
    • nmjenkins 2y ago
• Hamuko 2y ago
  Absolutely hate it since it makes auto-filling the password with a password manager a pain and makes me believe that UX designers are all useless. Then there's the absolute dogshit of Bitwarden with SSO.
  • vladvasiliu 2y ago
    Yeah, I used to consider that a PITA for the same reason. Now, 1password at least can autofill those most of the time. Sure, it takes a bit longer, but it's only annoying at this point since I don't have to click several times anymore.