Your fancy website login completely breaks when using a password manager.

[Oem42 0]

Why instead of just showing the fields for username and password do you hide the password field until the username is filled and you have to press continue.   I use lastpass and I have to make it fill the fields twice because it cant autofill the password field on the first go. Really annoying for what looks like an aesthetic decision. 

 

 

[Magnus Westin 23]

I agree, this new trend that I'm starting to see (not just evernote doing this) is really annoying. Please make it easier to use password managers, not harder.

[PinkElephant 8,117]

The 2-step-approach is probably used because of a new hacking strategy called „spraying“: Instead of brute-forcing one account, many accounts are tried with a combination of user & PW. Because a lot of users use weak passwords and the same few mail services, it seems to work. And it is harder to detect than brute forcing the same account over and over.

By expecting a valid user before unmasking the password field, this will not work. The robot that is used to fill the fields needs to wait for the web site to unmask the second field. The little wait breaks trying many accounts in a short time.

This is AFAIK done for security, not aesthetic.

[Magnus Westin 23]

I guess that could be the reason, but they can just as easily accept both username password and just delay the login with the same amount. Also if they accept both and just gives a generic error, then the "bad actor" dont know if it was the username or password that failed.

[bishopblaize 66]

6 hours ago, PinkElephant said:

The 2-step-approach is probably used because of a new hacking strategy called „spraying“: Instead of brute-forcing one account, many accounts are tried with a combination of user & PW. Because a lot of users use weak passwords and the same few mail services, it seems to work. And it is harder to detect than brute forcing the same account over and over.

By expecting a valid user before unmasking the password field, this will not work. The robot that is used to fill the fields needs to wait for the web site to unmask the second field. The little wait breaks trying many accounts in a short time.

This is AFAIK done for security, not aesthetic.

Google and Microsoft's online services both play nicely though. If you use a password manager to autofill your login details to either of them, it won't let you reach the password field without a valid username, but once you reach the password field, its already filled in.