91

I am not asking about the two factor authentication process where the user needs to enter both a password and a one-time-password.

Gmail recently (I don't know from when exactly) changed their login process which is depicted in the following screenshot:

Screenshot of Google's login flow

So, the new steps are as follows:

  1. Enter email
    1. Click Next
  2. Enter password
    1. Click Sign In

as opposed to the previous and usual way of logging in:

  1. Enter email and password
    1. Click Sign In

Isn't the new process non-user friendly requiring extra user interactions?

Since, Google does not usually make UX blunders can you explain the reasoning behind the new process? I'm looking for details like user interaction simplicity or any other hidden advantages.

Note: The question linked as duplicate doesn't cover the reason behind the change while Mervin Johnsingh's answer cites Google's reason.

  • 1
    @curious_cat yeah same with me - something is hidden behind the process so waiting for better explanation – exexzian May 15 '15 at 6:37
  • 1
    @curious_cat Well now your point makes sense - phishing protection could be a strong reason. google isn't showing any secret text but it does verifies the email id for correctness before sending the user to next step. – exexzian May 15 '15 at 6:48
  • 1
  • 1
    @merqri though the part of ques does say about 2 step thing but the context of both the question are different – exexzian May 15 '15 at 6:54
  • 1
    @curious_cat yeah I reasoned out that later – exexzian May 15 '15 at 7:08
65

As per the official Google announcement, the reasoning behind this change is to try out methods which would complement new password authentication methods. To quote the post

Today, you sign in to Google on a page that includes both the ‘email’ and ‘password’ fields on the same page. We’ll be gradually splitting those two fields into separate pages in the coming days; the sign-in process won’t change otherwise.

As we’ve said many times, we're working towards introducing new authentication solutions that complement traditional passwords. We’ve already separated the ‘username’ and ‘password’ fields onto separate pages on a successful launch in Android last year. This change to our web sign-in page is another step in that direction.

To help make sign-in easier and more personal, you may see a screen with your profile picture and full name when signing in to Google. We’ll only show this information if you are signing in from a location or device you’ve signed in from before, like your home computer.

This new Google account sign-in flow will provide the following advantages:

  • Preparation for future authentication solutions that complement passwords
  • Reduced confusion among people who have multiple Google accounts
  • A better experience for SAML SSO users, such as university students or corporate users that sign in with a different identity
    provider than Google

Now to add on to why Google might have gone with this approach other than the password augmentation mentioned in the quoted post above here are my thoughts'

  1. Consistency with the sign in interface which is currently being used while setting up android thus ensuring there are common interaction patterns as shown below

enter image description here

  1. Establishing a singular point of focus : The single form fields enable the user to focus on a single interaction point on the screen i.e. first the login and second the password without getting distracted.

  2. It also allows them to potentially enable more personalized customization options for security such as phrases or images providing more security options as shown below (Banks use this method ). This would reduce the scope of phishing as the screen generated would be specific to the user and would vary from user to user.

enter image description here

  • 4
    I would think this also slows down any bots or humans attempting to crack it, too. – Rob May 15 '15 at 12:24
  • 2
    @Mervin your each edit makes me to upvote you each time. We were discussing about this context on comments and offline with my peers here This would reduce the scope of phishing as the screen generated would be specific to the user and would vary from user to user. – exexzian May 15 '15 at 16:02
  • 2
    How does the phrase/image thing actually improve security? Surely a phishing site could ask for the username, quickly send that to the real site to get the phrase/image and then show it to the user? And wouldn't this mean effectively training users to think "showing my image = secure" when in fact anyone who knows the username can find the image/phrase? – codebeard Jun 5 '15 at 6:14
  • 2
    @codebeard As I understand it you will only see the custom login page with image and everything, when logging in from a registered Device on which you have logged in before. So a phishing site will not be able to load this image! The only way to get it would be via JavaScript Injection to load it on the users PC – Falco Jul 29 '15 at 7:43
22

Official google explanation aside (as mentioned in the other answer), there is probably another work at play which goes unmentioned - using UX as stick/carrot method to promote desired behavior.

Note that if you at any time previously checked the "stay signed in" checkbox, even after logging out of the Gmail the google will remember your username (via special cookie). Thus, when you come to gmail again, you'll only be presented only with second window (slightly changed to allow logging in as different user), instead of having to go through both of them (if you decide not to stay signed in).

While cleverly disguised as "as a convenience to the user" (for the users who opts to stayed signed in), it is probably deliberately designed as inconvenience for the users who prefer not to stayed signed in (having to wait for extra windows) - to make them give up on their privacy efforts. (vast majority of people will cave in and give up on things if you make it inconvenient enough and tempt them with easier ways)

Reason "why would google do it" is simple - if you stay signed in, they can track you much better as you go around on the web, and thus make more money. So it might probably benefit Google bottom line more then reasons mentioned in official explanation

  • 5
    But google was already doing that. Isn't that ? once choosing stay signed in and then logging out and then trying to log in - it use to prompt the similar window where we only needed to enter our password – exexzian May 15 '15 at 12:33
  • 2
    That's correct @exexzian. – Kroltan May 15 '15 at 13:49
  • 1
    @exexzian of course if you did not choose to stay logged in before you had to enter both username and password (barring any client-side browser auto-fill on, of course), instead of just password if you had been signed in. The added inconvenience in new method (for those who choose not be signed in all the time) is that they now have to click through TWO windows instead of ONE which they had before (thus type type click becomes more tiresome type click wait_for_new_page_load type click) – Matija Nalis May 15 '15 at 18:16
  • 13
    To add support for this theory, note that if you untick "Stay signed in", Google will pop up a dialogue to shame you; "For your convenience, keep this checked." Also, if you untick the box but put in the wrong password, Google will return you to the PW entry screen but subtly the "Stay signed in" box will be checked again. This seems deliberate to me. It's easy to overlook this when trying to submit a password for the second time. – codebeard Jun 5 '15 at 6:20

protected by Benny Skogberg May 30 '15 at 4:47

Thank you for your interest in this question. Because it has attracted low-quality or spam answers that had to be removed, posting an answer now requires 10 reputation on this site (the association bonus does not count).

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.