3

I use Walmart's Bluebird card (basically a pre-paid card which I deposit money in). When I go to their website (http://bluebird.com) and click "Login", my browser opens a brand new window. This new window is not JUST for logging in - after I log in it becomes my primary window, and the old window seems to serve no purpose.

Is there some good reason they might have for keeping the original window open, after sending me to a new window/tab (where I remain for all my account access)?

5

Yes, it's not something made for User Experience (on contrary) but to improve security.


Imagine this situation.

You're accessing one secure site, home page is not secure (it uses HTTP protocol) to greatly reduce server CPU usage (because homepage is requested very often by random users and search engines or because it contains non-critical material). You enter your credentials and you login then you're redirected to a HTTPS encrypted connection and now you're sure no one will be able to read or alter your data packets.

However if your network is unsecure someone may sniff data you send. This is not a problem with HTTPS because it's encrypted but - do you remember? - you logged in using HTTP and you've redirected to HTTPS after that. If attacker sniffed your credentials (in plain text) then he can effectively act as a man in the middle. HTTPS connection is secure after it has been initiated, not before.

In this very specific case certificates for homepage and login page are issued to different companies (and I'd guess the one for homepage is a generic certificate issued to hosting service provider).

OK but why new window? Can't we just reuse existing window/tab and start a new HTTPS session? AFAIK for three reasons:

1) To prevent possible attacks. This topic is out of my knowledge then please refer to Triple Handshakes and Cookie Cutters: Breaking and Fixing Authentication over TLS.

2) To make clear to user that a new secure connection is started. It's maybe the only UX point.

3) To be sure (or greatly reduces chances that) browser bugs and plug-ins loaded by previous pages aren't still loaded in same session/process. Especially if you don't force your users to use latest full-patched browser version then this is main reason to still open a new page nowadays.

EDIT: if we ask ourselves "is this still required nowadays?" then answer is probably "no, maybe it's not" but banks (and company which offers financial services) tends to be little bit conservative about security especially if they don't limit their users to use latest full-patched browser (when they even still have in use Windows XP computer with Internet Explorer 7)...

  • 1
    Interesting idea. But in this particular case, the homepage DOES use https (in fact, if I request http version, I get redirected automatically to the https version). – loneboat Jan 27 '16 at 15:22
  • 1
    I don't find this explanation very compelling. If this is true, then wouldn't I expect any site handling sensitive information to do it? But they don't. Even when there is a switch from http to https. – user31143 Jan 27 '16 at 15:54
  • 1
    If it's a vulnerability in the certificate, https or SSL, there is no explanation why would a new window improve on security... – JotaRMonteiro Jan 27 '16 at 15:58
  • 1
    Yes, sure. But wouldn't a new page suffice for a new session? Isn't the question about the need for a whole new window? – JotaRMonteiro Jan 27 '16 at 16:03
  • 1
    Another issue solved with a new page is to make sure the user isn't trapped inside an invisible iframe which could potentially survive the switch to https. – bendataclear Jan 27 '16 at 16:27
0

While this is ultimately speculation, I think this was a design/implentation decision to separate two sites with different purposes.

  • When you are not logged in, you are viewing an advertisement site for the service.
  • Once logged in, you access a site that lets you work with your account.

There really isn't any overlap between the two, so they were probably designed as two separate websites with different designs to fit their purposes (I don't have an account, but I assume the site after logging in isn't a single page design, which wouldn't be very usable for managing one's account).

That said, I think opening a new window was a poor design decision. There is no UX rationale for doing so, since someone with an account doesn't need to view the advertisement (and vice versa). But there are still plenty of cases of unnecessarily opening new windows on the internet, and this is probably one of them.

  • I agree with you it's a bad UX choice but it's a (pedantic? maybe) security measure. BTW especially useful for users running on old browsers – Adriano Repetti Jan 27 '16 at 16:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.