Hacker News Reader

Comment by drcongo | Hacker News Reader

I despise Google's login screens. Two separate forms, one for just an email address another for just a password. Why? Why should I have to invoke my password manager twice just to fill in two fields? I can't think of a single sane reason for doing this.

View on HN

This is because certain email addresses have SSO enabled and don't use a password. The only way to know is to get the username first and then redirect to the right place.

Not only SSO, but also two-factor authentication. Without asking for the user identifier first, you don't know which authentication method to present, because this varies per user account.

The alternative is to let the user choose the authentication method right on the first screen, but that would mean showing all possible methods (some of which may be limited to certain groups of accounts) and getting a lot of users stuck because they chose the wrong method.

So leave the password field empty if you want to use SSO, but keep it for standard Google accounts, so at least people using those don’t have to deal with the madness?

That's how it used to be.

The reason why they do this is because of sso logins for other organizations.

For example, to log into my college gmail account, I type my email, get redirected to the schools sso page (retype my username and password), then get redirected to gmail.

>retype username

That's even worse than the non-sso sign in flow. It definitely doesn't have to be that bad.

Since I use a password manager, its not really an issue unless I have to login on some random lab computer.

At the place I work we use office 365. Their sso path is so much better. I never need to re-enter my username.

Both Chrome and Firefox handle that form just fine. In my case it's four steps: login, password, hardware key, and clickthrough. It is fast and painless though.

Plus if you have a bunch of tabs open (G Suite), it will log you in all of them once you log in on one.

> four steps

Oh god... How a human being can stand this humiliation? I image this inflating to eight steps in 2030: login, password, 2FA key, face scan, reCAPTCHA, ID scan, phone call, click checkbox in AI TOS no one reads, final click on “We’re done!”

I expect it to only be one, silent step involving your Titan X brain chip by 2030.

You two should write a Point Counterpoint article somewhere.

Reply on news.ycombinator.com