2

In the Web 1.0, when a site required user authentication, you would have one single page with two fields: one for userid and one for password. But recent sites use two different pages, one for the userid and one for the password.

Is this just a design fad or is there a technical/security reason behind this?

4
  • 1
    One of the reasons both fields were good security wise, was that if the username or password was wrong you could give 'invalid user/pass combination' and anyone trying to get in wouldn't know if it was a valid account with wrong password, or just an invalid account (so the person trying to break in wouldn't know if they'd hit a valid account, and just focus on guessing the password). Now you can type a username in and see if it's valid before attempting to guess a password. I'm guessing there must be some other process that mitigates the decrease in account security.
    – Smock
    Dec 3, 2019 at 16:24
  • 1
    Smartphones are partly to blame with their small screens.
    – harrymc
    Dec 3, 2019 at 16:31
  • @Smock Nothing mandates that you should check the userid before you go to the other screen.
    – xenoid
    Dec 3, 2019 at 16:53
  • @xenoid I know. I'm comparing it to Amazon and Gmail which are 2 of the main sites I know that exhibit this new split page behaviour - They will tell you the account doesn't exist before asking for a password. I never mentioned it being mandatory for all websites that have split user/pass screens - that would be one heck of a standard (and one we'd all be aware of probably)
    – Smock
    Dec 3, 2019 at 16:59

1 Answer 1

2

If a site uses 2FA, then it needs to validate the login id before deciding what to do next, ask for a password or send a text with a confirmation code.

1
  • Makes loads of sense...
    – xenoid
    Dec 3, 2019 at 20:32

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .