Take the 2-minute tour ×
User Experience Stack Exchange is a question and answer site for user experience researchers and experts. It's 100% free, no registration required.

My boss has insisted for a while that our login process be divided into two steps on separate pages: on the first page, ask the user's e-mail address. On the second page, either display "user found" and ask for password, or "user not found" and ask for e-mail again.

He insists it is much easier for our users who often forget their credentials or if they even have an account yet. I've long been against this approach because it forces every user to go through two steps every time they login. (I also wonder if it's a security concern, knowing that it will confirm when an email exists in our system.) I would prefer to have a more standard login page with e-mail (all of our usernames are e-mails) and password, and one very clear link for "forgot password?".

Neither of us have any hard data to support our theories, and we have more important things to do than A/B test something that he doesn't think is even a problem. I was just wondering if anyone here could provide some arguments or hard data for or against either approach. I enjoy considering UX design, but I am not an expert.

share|improve this question
17  
Why make the process more long-winded for everyone just to make it (hypothetically) slightly more convenient for the people that forget their details? Unless you have a large percentage of users that forget their login information - (which would probably speak more about the complexity of the user ID requirements than the usability of the login screen.) –  JonW Apr 24 at 14:42
1  
Preaching to the choir, and I've used that argument before. User ID requirements are not complex. Every username is an e-mail address, so there's no extra username to remember. At worst, the user might forget "which e-mail did I register with?" which happens (I'm only guessing here) to maybe 1%. –  Michael Apr 24 at 14:52
4  
If an user-name check is wanted, why not add an async check in the "de facto" username+password login screen? Try to sign up with username "qwerty" on signup.wordpress.com/signup (as suggested by Francis Pelland) –  Jørn E. Angeltveit Apr 24 at 15:35
    
@Michael try to convince your boss based on security concerns well explained by Charles Wesley below. You don't have much chance to win him over in UX domain. –  kaptan Apr 24 at 22:50
    
Related: ux.stackexchange.com/questions/51785/… –  cimmanon Apr 24 at 23:24

14 Answers 14

On the second page, either display "user found" and ask for password, or "user not found" and ask for e-mail again.

One compelling argument against the two step approach is that the proposed design would allow for any unauthenticated person to determine if an email account has registered with that site.

This is a problem both for security and for privacy.

As a user, I would not want a site to confirm for just anybody whether I have signed up for their service.

As a developer, I would not want my application to voluntarily give a malicious user an easy way to enumerate user accounts.

Either of these are pretty compelling downsides to the approach. I would recommend focusing on making the "i forgot my password/username" process easier for the small percentage that need it rather than changing the login process for everyone at the expense of their privacy and potentially their security.

share|improve this answer
    
Thanks for your input. I've actually used both the security and privacy arguments before, but will continue to push those. I probably should have phrased the question more along the lines of "how do I convince my boss he's wrong?" but I wanted to see what you guys had to say first. –  Michael Apr 24 at 14:59
    
There's really no problem with this unless it's something such as a bank account. Most websites you can just search for users. –  Chipperyman Apr 25 at 0:43
2  
@chipperyman573 That assumes the question is about a public-facing site where the users can interact. None of the products I work on allow such a thing - clients and third parties can't know who else is also one of our clients. –  Izkata Apr 25 at 1:06
    
There are security benefits to this approach, as well. –  Joel Coehoorn Apr 25 at 2:12
2  
Personal Capital uses the split approach, which has access to your bank accounts. They specifically split it to show a security image to verify you're not on a phishing website. However, I find it more annoying as it breaks the automatic username/password fill on software like KeePass. –  Will Eddins Apr 25 at 15:30

If you want something compelling that your boss can grasp then I suggest you speak to him in the universal language known as money, dinero, ducats, dolla-dolla-bill-y'all

Your current situation

You:

Your suggested design will create a security flaw and your system is bound to get scraped for valid usernames

Boss:

Do what I say and tell the magic computer box to not be insecure

What you should aim for

You:

Designing the login system to accommodate a 2-step process with the error messages of 'User found/not found' would allow our competitors to easily obtain a list of usernames in our system. If some of the usernames match up to the usernames in their system then they will know who to target if they want to lure your users/clients away from you. Even if your usernames do not match up to theirs, your competitor will have a comprehensive list of domain names which you do business with.

Boss:

Holy crap you are right, is there anything we can do to mitigate this leakage of data?

You:

Unfortunately there is no 100% way to distinguish a real user who cannot remember their username vs a competitor trying to get data. Never displaying a 'User found/not found' message is the most secure route we can take no matter if it is a 1 or 2-step login process

Caveat

You might be giving this information away already but in a less convenient way:

Do you have an online registration page where the user is warned if the username is already taken? <-- your boss could easily throw this in your face.

^ The only difference between doing this vs the 2-step login page is that the registration page usually requires a lot more fields to get filled in and must pass other validation checks along with a Captcha or something.

share|improve this answer
1  
Great argument. And I feel like I've had that exact conversation before in a past life! –  Charles Wesley Apr 24 at 15:56
4  
"Do you have an online registration page where the user is warned if the username is already taken?" What I wouldn't give to have a boss/product manager this perceptive... –  Malvolio Apr 24 at 17:37
    
the caveat, hillarious )) –  c69 Aug 6 at 8:14

The general rule is, every page of process drops the success rate by 50%. It's probably a little bit of an exaggeration, but people think of a page as one unit of work, almost regardless of how difficult it actually is. A two- or three-page wizard starts to feel burdensome.

EDIT: somebody complained to the mods that there's no citation for my answer. The only cite I have is "that's what the UI people always tell me". Perhaps some kind soul could provide either a cite that discusses the prevalence of this received wisdom or one that actually confirms it (or even debunks it).

share|improve this answer

This post does not cite any references or sources. Please help improve this post by adding citations to reliable sources. Unsourced material may be challenged and removed.

3  
That's a fantastic general rule to remember, even if it's exaggerated. Unnecessary steps are my #1 pet peeve of bad UX, and I try to avoid it (hence my stance on this subject). I'd love some actual real life statistics like this to throw (or present) in his face though. –  Michael Apr 24 at 17:40

I'm not sure if this is exactly a UX concern, but password managers (LastPass, KeePass, etc.) can be configured to automatically or semi-automatically fill in username and password fields when they appear on the same page. But as far as I know, none of them will recognize a password field by itself, without a corresponding username field. Perhaps they could be programmed to do so, and thus the "blame" for this situation should rest with the authors of the password manager and/or its browser interface, but for now the reality is that separating the username and password fields on different pages means I have to manually copy the password out of the password manager, which significantly increases the number of clicks it takes to log in.

share|improve this answer
    
+1 This is exactly why I hate multi step logins. Even with quite advanced autotyping features you aren't able to login. Instead of using a single keyboard shortcut, you need to open the manager (1) search and find the entry (2), copy (3) and paste (4) username, go to next page (5) ,copy (6) and paste (7) password, finally login (8).. Afaik the browser (or a browser plugin) would be responsible for a feature to enable password managers to identify particular input fields. Keepass usually relies on window titles, but most multi page logins never change the title (especially not when using ajax). –  kapep Apr 25 at 14:34
    
I would think this issue could be resolved by having two login screens, each with a username and password field, having a blank password entry on the first screen go to the second, and having the second screen pre-populated with the username from the first. Users would then have the choice of whether to see the "anti-phishing confirmation" screen before entering their password. –  supercat Apr 28 at 16:21

The biggest risk I see to this as you mentioned is for security. HOWEVER some companies have managed to use this dual step process in a way that improves security also. Essentially what those companies did is asked each user to add an image to their profile, this image would show up after they have put in their email. If the image matches the one assigned to their profile they should put in their email address. If the image doesn't match anything on file, they show a random image (perhaps based on a hash?).

However, that does not solve your problem (or maybe it does?). Your problem of saying account found and account not found can also be solved with AJAX (or similar) by turning the field red if the email/username is not found. This removes that additional step.

Depending on how security conscious you may be the AJAX approach would be the best for UX. Normally I would say that this is a bad move and it shouldn't be done. But if you can put in safeguards to limit the number of lookups by IP / cookie. It would at least make it somewhat safer.

share|improve this answer
2  
The image idea is a good one if you are all worried about phishing (even better if you back it up by telling the user if his IP is familiar or not, which helps fight man-in-the-middle attacks). –  Malvolio Apr 24 at 17:27
2  
Another advantage of this approach is that it can help users in the case where they had to use something other than their normal username because the username they wanted was taken. If a person had selected a picture of a tractor as an image but on typing his username he gets a picture of Justin Bieber, he'll know that even if an account exists with his preferred user name, it's not the right account and he should try a different username rather than trying different things he might have used as a password. –  supercat Apr 24 at 19:14

This approach goes against the principle of having as few steps as possible and, thus, very likely reduces user satisfaction and conversion.

Other downside is leaking of privacy (making it dead easy to check whether some email is registered or not).

The upsides I see are purely design and programming related, e.g. you get a cleaner design by not having to add password field and signup / forgot password links on the main page. So less things to worry about and draw attention to. Also sometimes, depending on the backend logic, framework or cms you are using, it could be easier to structure this process in this way. However, those are not UX related issues and your users don't gain much by that, if anything.

What is more, why would you ask for e-mail again? Its a lot of effort to type in their email on user's behalf. If you decide to go with this pattern, just show the e-email entered and have user confirm that it is correct.

share|improve this answer
    
Thanks for your input. I completely agree on all points. The "as few steps as possible" is my biggest pet peeve of this approach. I should however clarify that the system doesn't currently ask for their e-mail twice. It asks for it on the first page, then prefills it on the second page. –  Michael Apr 24 at 15:03
    
In that case, consider this scenario: User tries to log in with email asfd@gmail.com, which is not registered. The email form is preffilled and user notices his error and quickly changes asfd to asdf, which is his email he has registered in your site before. Without reading any of the labels much (as we mostly do) he just thinks that its still login screen and enters password twice thinking that it will log him in, but the system actually tries to create a user with an email that already exists. How would you graciously allow your user to recover and proceed without creating confusion? –  Harijs Deksnis Apr 24 at 15:15
    
@HarijsDeksnis - I think the user only gets the page asking for email AND password, if the email entered on the first page was found to belong to an account. If the email is not found, the user sees an error message, and is asked to re-enter/submit their (valid) email address before they see the page asking for their password. I don't think that on either page, entering (or changing) an email address (whether found, or not-found) would invoke a "register-new-account" process. –  Kevin Fegan Apr 25 at 4:04

I thought I must offer at least one reason to have a multiple page login.

The only real advantage (disadvantage in most cases) of using multiple pages, instead of one, is that the user is provided an expected flow they must carry out. This could help with sites that don't have a conventional flow or sites where the expected use case is a step-by-step process. One tactic used by sites where being a user requires payment is that it splits up content that needs to be entered to make the user feel committed in continuing.

I think there is at least one example of where the two page log-in makes sense.

Sites where the average user is not the average computer user, but instead is only on their computer when forced. Also, most users only sign in once or maybe a couple times and never need to log in again. This case is becoming less and less common.

I happen to mention this because I used to be phone support for a company that frequently had older men or women trying to figure out what they needed to do to get product(x) working for their child again. They had to enter an email and password at some point, but then didn't need it again until much later.

Quick overview on the User

This kind of user will log-in only once-in-a-great-while to do one particular task. When they get to the main page, they may become instantly lost with all the information (even if it doesn't seem like that much). They just want to log in, do something, and get out. Simplicity is this user's friend and the less options they have, the better. If they do have choices where they are not sure what to do, they try to go with what seems the "more common" choice, which could be determined by how much screen size it has or simply which option they saw first.

Comparison of Single-Page vs Multi-Page for above User

Single Page: First time user lands on entry page. Hopefully, the log-in/register portion is highly visible for this user. They may not notice the register portion or wonder if they already registered. After all, they did register on that one site a long time ago. They proceed to guess at usernames/passwords. Eventually, they try all known combinations and realize they need to register, or they finally notice the register option.

Multi Page: First time user lands on entry page. This time, the website asks for their username. (Which, again, should be highly visible). They enter their email and the website tells them the next step. In this case that step is to register, and the user has already filled out the email.

Conclusion

I didn't really mean to write a paper, but it was important to note that the expected use and target audience of your site have a large influence on design. It could be your boss expects the kind of use or audience mentioned above, or foresees a large number of users not knowing their username because of some other system which may be similarly named or connected. Maybe your boss himself is one who always forgets which username he used, or maybe he hasn't considered the fact that you could tell him whether the username is correct on the first page. I believe in most cases for today's world, a single page for signing in should be sufficient and desirable. There are some cases otherwise, however.

share|improve this answer

This discussion focuses too much on a valid user trying to gain access. It is a huge security flaw to announce to the would-be hacker as to whether the ID and PASSWORD combination presented was bad due to id or password. Breaking log in into two parts and announcing which failed makes the hackers' job orders of magnitude easier.

I always post "Invalid ID/Password Combination"... keep the hackers guessing!

share|improve this answer

Purely from a user experience standpoint, I would keep it as one page, but explicitly specify why the login didn't work.

Saying something generic like "username or password was wrong" is ambiguous and leaves a lot to be desired. I find it to be a source of immense frustration, because it's not particularly helpful. Which was wrong? Was it my username or my password?

I think arguing that it's a security risk is overblown. As others have mentioned:

  • virtually all sites prevent duplicate email/username logins. How is telling someone that a username/email is already in use any more safe than saying "your username was incorrect"?
  • almost all "forgot password" links require that you enter your email/username for password retrieval; in almost all cases, if you enter an invalid username/email, it'll spit out a message like "this username/email does not exist in our system"; again, this is effectively the same as saying "username was incorrect" during the login process.
share|improve this answer
    
It's perfectly possible for the "forgot password" system to say "OK, I sent the reset instructions to your email address" even if it did no such thing because the account doesn't exist. –  David Richerby Apr 25 at 10:50
    
So, the reason for not being ambiguous in response to a failed log in attempt (ID/Password combination) is to point to another security risk? Hmmm, to paraphrase 'there exists cyber-crime already on the Internet, so why should I take any reasonable steps against it'...? –  Andrew Apr 25 at 13:45
    
@DavidRicherby “In almost all cases” does not imply that it's impossible, just uncommon. –  Gala Apr 26 at 6:54

Hmmmmm. Many arguments against the two step process.

However, many financial institutions do exactly that. Many banks and brokerages. In the last three days, I logged into three financial institutions that use this method.

share|improve this answer
2  
Banks and similar sites have different requirements though. they will have userID and password on one screen and then a second authentication on the subsequent screen. It's for security rather than to help the user. –  JonW Apr 25 at 20:36
    
Online banking at my bank used to work exactly that way (Go to “online banking” -> Enter details and move to next page -> Enter one-time code). Now, they still use two factor verification but it's all in a popover on the home page so it seems that multiple page ID wasn't an absolute requirement. –  Gala Apr 26 at 6:42
    
Some banks (I have no numbers, but have been exposed to this) –  l0b0 Apr 27 at 9:17

Others have commented on the security and privacy issues. I personally think they are a bit overblown (see @user34305 remarks) but in any case, it's only a reason to avoid being specific in the feedback. You can still put your login process on one page and inform the user that the username is unknown (dynamically or not) or have two pages but only display an uninformative message at the end.

But even if you end up revealing whether the email address is known to the system, there are still good reasons to keep it all on one page. One that hasn't been mentioned yet is that respecting de facto standards is generally good for usability. Don't break user habits and expectations without a good reason and careful consideration. And submitting user name/email and password on the same page seems pretty standard.

share|improve this answer

I read a blog post a couple of years ago where Mailchimp were able to reduce failed logins by 66%, mostly due to letting users know if it was their username or password which was incorrect:

https://blog.mailchimp.com/social-login-buttons-arent-worth-it/

They still did it with a single page, just changed the error message.

share|improve this answer

I would present the argument to the boss using simple maths. Suggest to him that the user ID and password could each be two digits and ask (show?) him to calculate the number of permutations to guess a valid combination (assuming only one exists in the system).

With the separate login / password approach, you have a 1:100 chance of getting the correct login, and then another 1:100 of getting the correct password, so it is a 1:200 chance of getting the correct login / password combination.

Contrast this with the 1:10,000 combinations for the combined login / password approach then extrapolate.

Hell, if it comes down to it, write a simple program and make him try it. Unless he really doesn't want to protect your data (so why password it?) he has to be made to understand the basic maths associated with the two step approach and how this will affect the security.

Frankly, I wouldn't use a site that used a two step approach for this basic reason, unless some other factor (two-step...) was involved.

share|improve this answer
    
On some sites, anyone may easily acquire a list of hundreds or thousands of valid usernames, so telling a crook that a username is correct when the crook knows that anyway wouldn't impart much information. On the other hand, if a site allows each user to select a combination of icons, entering a valid username will show a user's selected icons, and entering a non-existent name will cause the system to use a hash of the name to select icons to show, that would let valid users know they typed the name associated with their account (not merely a name that exists) but tell crooks nothing. –  supercat Apr 28 at 16:25

This is something I see very frequently throughout the interwebs; people are scared of giving the error message "Account does not exist", because hackers could figure out which accounts DO exist.

However, these fears are VERY unwarranted. Simply limiting the amount of times a user can attempt to "guess" a username mitigates much of the risk, just like you would limit the amount of times a user can guess at a password. In addition, if you have a public registration form anyone can check whether a specific account already exists or not anyway. With just a basic level of security precautions, this extremely convenient feature becomes just as safe as any other component.

To answer the other part of your question, why does the form need to be two separate pages? You could still have two separate checks, one for username existence and one for password correctness, but on the same page. This is how I do it, and how I would recommend others do it.

share|improve this answer
1  
"limiting the amount of times a user can attempt to "guess" a username mitigates much of the risk" -- how would you propose doing that? –  Malvolio Apr 24 at 17:20
3  
Block "them"? Since they are not logged in, you don't have any idea who "they" are. If they were attacking a particular username, you could block that username... but by definition, they aren't. You could block an IP, which would deter a low-skill attacker. Plus, you haven't solved the reverse problem: the attacker wants to know if Ahuaehauheau@gmail.com is a member of herpessupport.net. –  Malvolio Apr 24 at 17:32
1  
Thanks for your input. Good points re: security. Re: "why does the form need to be two separate pages?": I agree. That's how I would prefer it, and I will start adding some AJAX checks. My boss's argument is that putting a login with both fields in front of a user who doesn't know their username AND password is confusing, so giving them one at a time and confirming along the way helps. While it might help some, I've disagreed and think it adds an unnecessary step for the majority of users. –  Michael Apr 24 at 17:37
1  
In the abstract, the idea that too many fields might confuse a user is legitimate. In this particular case, there are probably fewer people who haven't seen a username/password login form than people who have never seen a cow. At this point, I would worry less about resolving your users' anxieties and focus on resolving your boss's anxieties. I think she is acting out of some more generalized concerned about the process and thinking "Since I am confusing and worried about building this website, the user will be confusing and worried by using it." –  Malvolio Apr 24 at 17:54
4  
The big problem with blocking an IP is places that use proxy servers or carrier-grade NAT. For example, ten wrong guesses could block the entire nation of Qatar; if your site is being filtered by the UK's "Cleanfeed" system, a couple dozen bad guesses could block most of the country. At the other extreme, under AOL's old outproxy system, someone could make thousands of guesses without being blocked because each page request would come from a different IP address. –  Mark Apr 25 at 6:52

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.