In the last year or three, most sites have been making password authentication worse than it used to be. Some of the ways: * Prompt for username & password in

In the last year or three, most sites have been making password authentication worse than it used to be. Some of the ways: * Prompt for username & password in such a way that the browser's username&password-saving doesn't recognize. (I suspect the site is usually leaning on separate form field autocomplete to get an email address or other username.) * Enter username in one DOM, submit, wait, and then they load a new page or change the DOM, to prompt for password. * Burying/obscuring the username&password option, in favor of an array of buttons to log in from various big tech companies own authentication (or misused authorization), log in via email or SMS link, etc. * Mandatory email/SMS 2FA, even for innocuous sites. * Slow 2FA. Sit around waiting for it, pressing the mail-check button repeatedly, like I'm a type-A person (trying to close the elevator door before someone across the lobby gets close enough we have to wait). * Then the 2FA email often has a bunch of worthless filler around it, so that I can't just glance at it in the small tiled window in the corner of my screen, but have to switch to the email program in a large tile, memorize or copy&paste it, and then switch back to the browser window. Which then often upsets the form field validation, or even loses the keyboard input focus it had before, just for that extra little negative UX touch. * I kid you not, one company's gratuitous mandatory 2FA emails the other day consistently had some invisible unicode character next to the number, which invisible character was picked up in the double-click copy&paste, sent through the form submission, and then they rejected the string as invalid 2FA. * The credit card company that insists on SMS 2FA (when I'm on desktop), and then sends an 8-digit code to my rather than a 6-digit like most other companies. Just in SMS, which is at a font size for text chats, not for perfectly transcribing numbers that are 8 digits without even separators like everyone else has used for most purposes forever. * All the companies that have recently started emailing me every time I "sign in on a new computer", from the same IP address and browser fingerprint as usual. This is starting to become the norm, and it's not only annoying, but it also presumably desensitizes a lot of people to legitimate emails about security. (If anyone ever logs into one of my accounts, I'd probably never know, amidst the the piles of irresponsible false alarm alerts about this.) (This is another bad practice by people seemingly trying to 'do security' like the one where banks would email you from address domains other than their own, at the same time that they're emailing you to watch out for phishing, like it's your moral failing.) * Some organizations are doing password expiration, on newly-developed sites. * Somewhat hiding the login button/link for existing accounts, but there's a big bright button for creating a new account. (Actually, this is a long-time practice by a number of sites, not recent, but some sites still doing it.) In most cases, I don't think it's dark patterns, to discourage people from logging out or clearing cookies, nor to make the more receptive to coming passkeys or to whatever side incentives (besides some users' preferences) the company might have for doing log-in-with-other-company. I think it's probably a bunch of developers just integrating off-the-shelf frameworks, sometimes spending a lot of effort to try to understand the off-the-shelf thing's particular proprietary bureaucracy, with little time left for the UX, security, or anything else. And maybe mix in some enthusiastic sprint tasks to add in other ways of logging in, incidentally making the original way worse, since the original way is not within scope of the task. And, in some cases, it might be a bad compliance checklist, or bad interpretation of one.