5 ms·

Google latest sign-in update is making a lot of people very angry

24 points by superasn 11y ago

fweespeech 11y ago
> As we’ve said many times, we're working towards introducing new authentication solutions that complement traditional passwords. We’ve already separated the ‘username’ and ‘password’ fields onto separate pages on a successful launch in Android last year. This change to our web sign-in page is another step in that direction. It may make them angry but its pretty clear Google is working towards a: "Username" -> "Auth Factor 1; Maybe not Password" -> "Auth Factor 2; Also maybe not Password" model.
jbob2000 11y ago
Some of the comments on that post hurt my brain. "Why did they do this!?!?". Did you miss the three points in the OP which totally explains why they did it?
jeffjose 11y ago
Why cant we have both? Like the 2FA? Have the users enter their user/pass in the first page. The second and third pages then asks the Auth Factor II or Auth Factor III fields
fsk 11y ago
Couldn't they accomplish the same effect with AJAX? I.e., display the 2nd bit based on which E-Mail is typed?
jtagen 11y ago
I've never understood the security benefit to having separate username/password pages. How does this help?
- ucaetano 11y ago
  It prevents someone from faking Google's login page (or any other service) to capture users' passwords. This is the same as showing a "trusted image" that you selected.
  - apendleton 11y ago
    Does it? What stops them from MITM-ing your answer on the first screen to get the trust image for the second screen? (In a way that's meaningfully different than the single-screen version, I mean, so not HTTPS certs.)
    - ucaetano 11y ago
      As TFA mentions, it only shows the image if logging in from a known IP or device, so the MITM won't have access to it, unless of course they can hijack your device or connection, but that's orders of magnitude harder than setting up a fake login page.
superasn 11y ago
I think the biggest problem with their new sign-in which most people are having is that it is more time consuming, i.e. two steps means clicking the sign-in button twice, waiting for transition between pages. Secondly, it breaks almost all password managers including Lastpass, and it breaks a lot of extensions like these[1] [1] https://chrome.google.com/webstore/detail/quick-login-for-google-ac/cbgngpehipfmfmpjmhonhacgbkjpdidp?utm_source=chrome-app-launcher-info-dialog https://chrome.google.com/webstore/detail/quick-login-for-go...
- nav1 11y ago
  That's not true, though. You would still have to either press tab (now enter), or click the second field to enter the password.
  - Veratyr 11y ago
    It's very true. The click isn't the problem, the "waiting for transition between pages" is the problem. Type username/password = ~1s each Single keypress = ~0.1s each Page load = ~2s Before: username + tab + password + enter = 1 + 0.1 + 1 + 0.1 + 2 = ~2.2s After: username + enter + page load + password + enter = 1 + 0.1 + 2 + 1 + 0.1 + 2 = ~4.2s Roughly doubling the amount of time it takes to enter your information is significant and annoying.
    - nav1 11y ago
      Except it doesn't even take a second for the password input to appear. Where are you getting those numbers from anyway? When I tried it, it only took about 152 ms for all the data to load after submitting the e-mail address.
      - Veratyr 11y ago
        It depends greatly on your location, connection and browser. Many users are stuck on low quality internet connections or mobile devices where things can easily take a full second or more.
- 11y ago
nosideeffects 11y ago
Google is in a transition to optimize for your account security over the convenience of saving 500ms every week or so by having a single page. For the business "this is wasting my time" complaint I just read a whole lot of: you're about to spend an hour or so reading inconsequential emails instead of doing anything productive anyways. What is another 500ms?
benstein 11y ago
Bank of America has had 2-part login screens forever. IIRC they are going in the opposite direction and will be putting them together in a single page very shortly.
- gohrt 11y ago
  Right, because if one day your sitekey is missing, you'll shrug and think "I guess my cache cleared, whatever", and not distinguish a data reset from a MITM attack.
ic-junk 11y ago
Every spammer will now know the full name of any google user since it's displayed on the second page. Eventually in the near future, even if you remove the name and keep the display image and the display image is of a person, face recognition software could determine who the person is due to Facebook and other social media platforms. Displaying a display image or showing the full name is a complete breach of security and privacy. Eventually one could theoretically find all Google accounts a person has with Google.
- nosideeffects 11y ago
  I thought it only showed this information if you had recently, successfully logged in to your account on that computer?
  - ic-junk 11y ago
    Yeah I suppose that is possible if they didn't spoof it or your device becoming compromised. I haven't seen/read anything on what they're doing to handle this scenario.
    - ucaetano 11y ago
      If your device is compromised, someone knowing which accounts your have is pretty much a given regardless of you logging in to Google...

24 points by superasn 11y ago

> As we’ve said many times, we're working towards introducing new authentication solutions that complement traditional passwords. We’ve already separated the ‘username’ and ‘password’ fields onto separate pages on a successful launch in Android last year. This change to our web sign-in page is another step in that direction. It may make them angry but its pretty clear Google is working towards a: "Username" -> "Auth Factor 1; Maybe not Password" -> "Auth Factor 2; Also maybe not Password" model.

jbob2000 11y ago

Some of the comments on that post hurt my brain. "Why did they do this!?!?". Did you miss the three points in the OP which totally explains why they did it?

jeffjose 11y ago

Why cant we have both? Like the 2FA? Have the users enter their user/pass in the first page. The second and third pages then asks the Auth Factor II or Auth Factor III fields

fsk 11y ago

Couldn't they accomplish the same effect with AJAX? I.e., display the 2nd bit based on which E-Mail is typed?

jtagen 11y ago

I've never understood the security benefit to having separate username/password pages. How does this help?

ucaetano 11y ago
It prevents someone from faking Google's login page (or any other service) to capture users' passwords. This is the same as showing a "trusted image" that you selected.
- apendleton 11y ago
  Does it? What stops them from MITM-ing your answer on the first screen to get the trust image for the second screen? (In a way that's meaningfully different than the single-screen version, I mean, so not HTTPS certs.)
  - ucaetano 11y ago
    As TFA mentions, it only shows the image if logging in from a known IP or device, so the MITM won't have access to it, unless of course they can hijack your device or connection, but that's orders of magnitude harder than setting up a fake login page.

superasn 11y ago

I think the biggest problem with their new sign-in which most people are having is that it is more time consuming, i.e. two steps means clicking the sign-in button twice, waiting for transition between pages. Secondly, it breaks almost all password managers including Lastpass, and it breaks a lot of extensions like these[1] [1] https://chrome.google.com/webstore/detail/quick-login-for-google-ac/cbgngpehipfmfmpjmhonhacgbkjpdidp?utm_source=chrome-app-launcher-info-dialog https://chrome.google.com/webstore/detail/quick-login-for-go...

nav1 11y ago
That's not true, though. You would still have to either press tab (now enter), or click the second field to enter the password.
- Veratyr 11y ago
  It's very true. The click isn't the problem, the "waiting for transition between pages" is the problem. Type username/password = ~1s each Single keypress = ~0.1s each Page load = ~2s Before: username + tab + password + enter = 1 + 0.1 + 1 + 0.1 + 2 = ~2.2s After: username + enter + page load + password + enter = 1 + 0.1 + 2 + 1 + 0.1 + 2 = ~4.2s Roughly doubling the amount of time it takes to enter your information is significant and annoying.
  - nav1 11y ago
    Except it doesn't even take a second for the password input to appear. Where are you getting those numbers from anyway? When I tried it, it only took about 152 ms for all the data to load after submitting the e-mail address.
    - Veratyr 11y ago
      It depends greatly on your location, connection and browser. Many users are stuck on low quality internet connections or mobile devices where things can easily take a full second or more.
11y ago

nosideeffects 11y ago

Google is in a transition to optimize for your account security over the convenience of saving 500ms every week or so by having a single page. For the business "this is wasting my time" complaint I just read a whole lot of: you're about to spend an hour or so reading inconsequential emails instead of doing anything productive anyways. What is another 500ms?

benstein 11y ago

Bank of America has had 2-part login screens forever. IIRC they are going in the opposite direction and will be putting them together in a single page very shortly.

gohrt 11y ago
Right, because if one day your sitekey is missing, you'll shrug and think "I guess my cache cleared, whatever", and not distinguish a data reset from a MITM attack.

ic-junk 11y ago

Every spammer will now know the full name of any google user since it's displayed on the second page. Eventually in the near future, even if you remove the name and keep the display image and the display image is of a person, face recognition software could determine who the person is due to Facebook and other social media platforms. Displaying a display image or showing the full name is a complete breach of security and privacy. Eventually one could theoretically find all Google accounts a person has with Google.

nosideeffects 11y ago
I thought it only showed this information if you had recently, successfully logged in to your account on that computer?
- ic-junk 11y ago
  Yeah I suppose that is possible if they didn't spoof it or your device becoming compromised. I haven't seen/read anything on what they're doing to handle this scenario.
  - ucaetano 11y ago
    If your device is compromised, someone knowing which accounts your have is pretty much a given regardless of you logging in to Google...