I ran across an article called Put the login on the front page, where the author wants sites to:
[...]put the user name and password box somewhere obvious on the home page like the upper right hand corner. Save me the click.
Is this is a good idea, or not? Or is it better to have a login link go to a separate page, for security (or other reasons)? Even if it adds a step.
Some things I noted from the article:
- The comments discuss whether this would allow a man-in-the-middle attack due to using plain HTTP on the front page, versus HTTPS.
- The article (dated 2006) lists sites that do put allow login on the home page, such as Fresh-meat and Slash-dot. Yet when I checked those sites, they had a separate login link, rather than the full login/password/login button as the author states.
- Those two sites obviously changed their login process in the past five years. I would have presumed for security reasons - but both use HTTP instead of HTTPS, so I'm not sure what the reason was.