Why do sites split 'password' and 'username' retrieval into two separate operations?

Question

I find this way of doing it highly annoying when I come back to a site I haven't used in a while. First having to enter my email to get my username and then enter my username and email to reset my password.

Why do sites split it up like this? Is it believed to be better UX? Better security?

I mean, the weak point is my email in both cases, so if someone got a hold of that they would get both the username and the password anyways. So why not just combine it into one function where you only need to supply your email?

Answer 1

Well, this is some kind of old approach imo. A while ago username was usually used for two purposes: as identity (to log-on) and as something to display (when you post comments for instance). I believe it came from standalone apps and operation systems, where email is something secondary and username is something primary. Meanwhile it doesn't work in a web, where user email is usually a primary thing.

Modern sites have better UX by separating a way you log-on and a way you communicate with other users:

• When communicating with other users, they only see your name, doesn't know how you actually log-in (email, smart card etc..).
• When it come to your identity, email (or similar unique id) is used. So when you like to recover ability to log-in, you just enter your email address and password recovery process starts. Name is not involved.

So, finally answering your question, this wrong log-in approach causes also a wrong recovery process.

Answer 2

I think the reason is that, when people forget their password, they have several pieces of information that they can use to retrieve it.

1. Their username.
2. Their email
3. Their security question.
4. etc.

However, when they forget their username, the sites can't use their username to find their username, because they don't know it. So the site has to use different pieces of information to find what their looking for.

Yes, in all of the cases the person still has their email, which can be used to identify their account, but it's still a good idea to get as much information about the account as possible, so no mistakes are made. By splitting up the process, the site is collecting as much information about the account as possible, so that they can be 100% sure.

In addition, most of the time people remember their password, but not their username, or vice versa. Separating the process makes it easier for them.

Answer 3

We contemplated using a one stop shop for resetting passwords and reminding users of their Client ID and Username (we're a mutli-tentant web-app, so we need both) but we decided against it for a couple of reasons:

1. Security: Having one field allows someone to not know your username and it also allows them to change the password of the account in one step.

2. Simplicity: due to the nature of our back-end services, we have multiple services that are used by our login system that made it easier to have multiple fields, like forgot username and forgot password.

3. User Guidance: By having a login help form that says: "To reset your password, enter in either your Email Address OR Client ID and Username" as well as a separate (although very close proximity) form saying "If you forgot your client id/username enter in your email address" has helped our clients better serve themselves.

Answer 4

I think it purely helps with the case if people can remember their password but have forgotten their username. Then a site can simply send out the username to the email address. This is safer, since it doesn't involve sending out the password in plain text. Or its less annoying because it involves needlessly resetting the users password - which means they have to go through the password reset process when they can remember their password.

If the user's forgotten their password then they should be able to click a link that says 'forgotten password' and an email with username and a new randomly generated password (or one-time token) should be sent to the user's email address.

Further to that as per this question the site could also accept both a username and email in the username input to avoid people forgetting their username. Then you only ever need the 'forgotten password' link.

Answer 5

This is for your safety.

Your identity (username) needs to be separated from your password because those 2 things are handled by different systems:

Google is moving towards strengthening the second part (passwords) with new technology, which doesn't work if it's all on one page.

The core problem is theft: with both in one place, it's too easy to steal them (eg. phishing, scammers, spoof sites, mitm, etc). The separation makes it possible to block the theft completely (via the new technology).

Answer 6

There is another reason why "progressive disclosure" on login makes sense. From time to time users should be forced to complete some tasks before they get logged in and see the main screen of the application, as

• change passwords (e.g. when accounts were hacked and users have to change passwords)
• complete profile setting
• answer security questions
• answer captchas from time to time

In such cases "progressive disclosure" helps to add one or more such extra steps during the login process by adding an extra screen for each of this steps.

Since this is part of an extended login process, login may be prevented if such an extra is not executed successful.

if there is no progressive disclosure available such extra steps wohld have to be implemented in a second step after successful login. And this requires extra forms and extra screens, too.

So, progressive disclosure is a good approach for an extendable and modular login process.