User Experience Stack Exchange is a question and answer site for user experience researchers and experts. It only takes a minute to sign up.
Sign up to join this community
I use Walmart's Bluebird card (basically a pre-paid card which I deposit money in). When I go to their website (http://bluebird.com) and click "Login", my browser opens a brand new window. This new window is not JUST for logging in - after I log in it becomes my primary window, and the old window seems to serve no purpose.
Is there some good reason they might have for keeping the original window open, after sending me to a new window/tab (where I remain for all my account access)?
Yes, it's not something made for User Experience (on contrary) but to improve security.
Imagine this situation.
You're accessing one secure site, home page is not secure (it uses HTTP protocol) to greatly reduce server CPU usage (because homepage is requested very often by random users and search engines or because it contains non-critical material). You enter your credentials and you login then you're redirected to a HTTPS encrypted connection and now you're sure no one will be able to read or alter your data packets.
However if your network is unsecure someone may sniff data you send. This is not a problem with HTTPS because it's encrypted but - do you remember? - you logged in using HTTP and you've redirected to HTTPS after that. If attacker sniffed your credentials (in plain text) then he can effectively act as a man in the middle. HTTPS connection is secure after it has been initiated, not before.
In this very specific case certificates for homepage and login page are issued to different companies (and I'd guess the one for homepage is a generic certificate issued to hosting service provider).
OK but why new window? Can't we just reuse existing window/tab and start a new HTTPS session? AFAIK for three reasons:
1) To prevent possible attacks. This topic is out of my knowledge then please refer to Triple Handshakes and Cookie Cutters: Breaking and Fixing Authentication over TLS.
2) To make clear to user that a new secure connection is started. It's maybe the only UX point.
3) To be sure (or greatly reduces chances that) browser bugs and plug-ins loaded by previous pages aren't still loaded in same session/process. Especially if you don't force your users to use latest full-patched browser version then this is main reason to still open a new page nowadays.
EDIT: if we ask ourselves "is this still required nowadays?" then answer is probably "no, maybe it's not" but banks (and company which offers financial services) tends to be little bit conservative about security especially if they don't limit their users to use latest full-patched browser (when they even still have in use Windows XP computer with Internet Explorer 7)...
While this is ultimately speculation, I think this was a design/implentation decision to separate two sites with different purposes.
There really isn't any overlap between the two, so they were probably designed as two separate websites with different designs to fit their purposes (I don't have an account, but I assume the site after logging in isn't a single page design, which wouldn't be very usable for managing one's account).
That said, I think opening a new window was a poor design decision. There is no UX rationale for doing so, since someone with an account doesn't need to view the advertisement (and vice versa). But there are still plenty of cases of unnecessarily opening new windows on the internet, and this is probably one of them.
