I need to load a second page to enter my password in some sites. Why is this? I even have a site I use that has the username, password and 2FA entries on separate pages that each need to be loaded one after the other.
My uneducated guess is that it makes it harder for bots, but I can't imagine it being that much of an impedance 🤷
Cheers!
23 Comments
faltryka@lemmy.world · 111 pts · 280d
This is called an identity first workflow and is used specifically so that they can route different people to different login ceremonies or providers.
They get your id first, and use that id to determine what your login ceremony is. Perhaps you’re with a business that they have an sso integration with and will send you on to your businesses sso provider, or perhaps you’re a local user for them and get a password screen next.
grue@lemmy.world · 41 pts · 280d
What pretentious asshole came up with that bit of jargon?
faltryka@lemmy.world · 51 pts · 280d
Me…
DV8@lemmy.world · 24 pts · 280d
I will steal it for work without giving credit! Thanks!
faltryka@lemmy.world · 13 pts · 280d
Do it! I work in the industry and have found it to be very effective in conversations spanning varying levels of technical expertise.
early_riser@lemmy.world · 6 pts · 279d
FurryMemesAccount@lemmy.blahaj.zone · 4 pts · 278d
So do I and I reckon it encapsulates well the painfully long and formal process it can oftentimes represent, especially with some 2FA solutions...
BastingChemina@slrpnk.net · 6 pts · 280d
I love it
NotSteve_@piefed.ca · 8 pts · 280d
Lol I've never heard that term but it actually does kind of work. Auth is something that is very standardised with it's communication between the FE and BE so the login flow could be compared to a ceremony. Kind of a silly way to describe it though
faythofdragons@slrpnk.net · 3 pts · 280d
I'm sure we can work daemons in somehow
village604@adultswim.fan · 4 pts · 280d
That doesn't explain why my Synology NAS does it, though, because I don't believe the web portal has the ability to handle different authentication flows.
I think it might also be a barrier against brute force attacks.
dustyData@lemmy.world · 10 pts · 280d
Synology offers cloud services and business level support for their enterprise products. They do support different authentication workflows, they are just not all included with the consumer products.
NotSteve_@piefed.ca · 5 pts · 280d
I've never used Synology stuff but it could be future proofing or a default feature of the authentication service/provider they're using (if they are using one).
For a NAS, it actually seems like something corporate customers would very much want to have SSO support for so I'd actually be surprised if there wasn't some way to set it up already
jol@discuss.tchncs.de · 2 pts · 276d
I still hate it and will always hate it.
corsicanguppy@lemmy.ca · -1 pts · 280d
The one thing MADE for JavaScript and no.
dev_null@lemmy.ml · 1 pts · 280d
It's often implemented with JavaScript, yes
mspencer712@programming.dev · 48 pts · 280d
Different domains need different authentication flows. If the provided email ends in a domain they recognize, instead of prompting for a password you’d be sent to another auth provider to authenticate there.
TranquilTurbulence@lemmy.zip · 19 pts · 280d
This is usually the right answer. In the past, logging in was a simple pipeline with no forks along the way. That’s why a simple username + password did the trick. Nowadays, logging in has become a complicated journey with several ways to get to the destination. Once the site knows your email, it knows what’s the next step in your case.
misterbngo@awful.systems · 25 pts · 280d
This is generally done when you have customers with SSO, the first one will take the email and if the domain is ssod it forces them through a particular workflow. Otherwise you get the other normal username/password flow
just_another_person@lemmy.world · 9 pts · 280d
Sometimes it's just UI/UX, sometimes it's to deter specific patterns they've seen from bots, users, or brute-force. It's really just subjective. One isn't necessarily better than the others though it does mess with automated input of credentials a lot of times.
Septimaeus@infosec.pub · 5 pts · 280d
just_another_person@lemmy.world · 3 pts · 280d
Nah, that's ineffective. A simple Captcha and lockout would do more to deter brute forcing than having two different forms.
Septimaeus@infosec.pub · 2 pts · 280d
paraphrand@lemmy.world · 3 pts · 280d
I always assumed some sites harvest what ever you enter in the first box. Especially if it’s an email address. But other people in this thread have the legitimate answer.
ChaosMonkey@lemmy.dbzer0.com · 0 pts · 280d
Some sites check if the account does not exist yet to show a registration form.
notreallyhere@lemmy.world · -1 pts · 280d
generic_computers@lemmy.zip · 2 pts · 278d
This login flow has nothing whatsoever to do with enshitification. Websites have used it before that term was coined. As others have said, it's basically because they use your username to check what login page to send you to.