6

I am using a browser-based password manager. For most websites the login workflow is:

  1. Go to login page. Both username and password field are visible.
  2. Credentials are auto-filled by password manager. If there are multiple credentials associated with this site, the first set is picked.
  3. (Optional) Select alternate credential set from a dropdown.

However, some websites (for example Google Accounts) have a two-step login. First you fill in your username and hit next, a new page loads, then you fill in your password and hit next, now you are logged in. (Note: So I don't mean two-factor authentication.)

With a password manager this becomes:

  1. Go to login page. Only username field is visible.
  2. Username credential is auto-filled by password manager. If there are multiple credentials associated with this site, the username from the first set is picked.
  3. (Optional) Select alternate credential set from a dropdown. Username from that set is filled in.
  4. Click Next. Password field is now visible.
  5. Password credential is auto-filled by password manager. If there are multiple credentials associated with this site, the password from the first set is picked.
  6. (Optional) Select alternate credential set from a dropdown. Password from that set is filled in.

So, if I have multiple credentials associated with a website, it is more difficult to log in with a password manager. If I don't want to use my default credentials, I must remember step 3 and 6, otherwise a bad username-password pair are picked.

Password managers are generally considered a best practice these days, including for everyday users. So I assume the UX designers must be deliberately breaking the workflow for "a user with multiple credentials stored in a password manager". Why? What benefit is gained from a two-step process that makes it preferable to a single-step process?

1
  • I feel like there's two distinct yet intertwining questions here, what benefit is gained from a two step login process, which has an answer here ux.stackexchange.com/questions/78805/…, and why would they choose a route that does not benefit password manager users? Is likely just that a majority of people don't use one: pewinternet.org/2017/01/26/…
    – DasBeasto
    Commented Feb 25, 2019 at 20:39

2 Answers 2

7

The current state is far from ideal, but it is the best solution for the 👇problem. The fact that some password managers are having a hard time working with it is another problem :)


This usually happens when the service starts offering other means of logging in, not only the email/password combination. For example services like Okta, or other corporate solutions. And these don't always need a password to log in. So the flow is as follow:

  1. Let us know who you are
  2. (A) You are a regular customer, so we will present you with a password input
  3. (B) You are a corporate customer, so we will present you with respective service

If you would keep it on one page it would get complicated rather quickly, especially if you would support more then one service. And even if you would support only one, you would end up with two email fields: one with a password and the other one with the corporate solution. It would lead to even more confusion.

3
  • You should write an article about this @rojcyk. After researching this subject your answer is the best sum up I've seen to explain it. The old method was email/pass to authenticate. But modern platforms likely need many steps and require many logical flows for authentication. email/pass are only two of these required steps. Commented Oct 19, 2019 at 21:49
  • @BenRacicot Thank you for the nice words and the idea! Is there something you would like to know more about?
    – rojcyk
    Commented Dec 16, 2019 at 11:25
  • @rojcyk I would disagree that this is the best flow available. On sites like Google, I'd guess a majority of users use the "email/password" flow. So present a two field page initially, but allow for an email only. If the user only enters an email, then see if it's a corporate account, and proceed through the current flow. If not, reject the login attempt that had no password. That doesn't change the flow for corporate users, it improves it for email/password users. and most important of all, it makes the site more friendly towards password managers.
    – dgnuff
    Commented Apr 20 at 22:27
1

At LearningStone (based on the Zotonic project) we decided to develop the two-step login to accommodate logging in from external sources.

Some users log in externally and bypass the visible login. But if at a later point they log in through our standard login, they first enter a username or email and then we check if we know where they are coming from and - if they were originally logging in externally - we push them back to that site. If we don't know for sure, we present a button which will optionally lead them back to the external site.

It does take some effort to make it possible to remember passwords, but we figured that if Google could do it, so could we :-)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.