Subject: [104attendees] Does anyone know the research on separate username/password prompts?

From: Sean Leonard <[email-masked]>
Date: Tue, 26 Mar 2019 17:46:42 +0100

Just thought I would ask the attendees at this meeting:

I had a hallway debate earlier today about whether it is better for users to be prompted to sign in with separate screens for the username and the password.

Example: Google log in flow shows the “Email or phone” prompt first, then after that is entered, the password. If the user identifier (email or phone) does not match an existing Google account, the error “Couldn’t find your Google account” appears. If the user identifier does in fact correspond to a Google account, the next screen says “Welcome <userid>” and prompts for the password. Other websites and apps may display a user picture or other things on the second screen, before the password is entered.

The counterexample (which is more common) is the user ID and password are asked for on the same screen. The failure response: “either your username or password is invalid”, leaves it ambiguous whether the user ID was unrecognized, or the user ID was recognized but the password did not match. Whether the user ID is valid, can be sussed out depending on how the “Forgot password” reset workflow is configured, at the risk of the real user getting a notice that an attacker is trying to break into their account.

When the user ID and password are separated, it may reduce security because an attacker can determine which user IDs are valid or not, and thereby narrow their attack. To the extent that the server displays user-specific information, security can also be reduced because an attacker can copy that cue and use it on a phishing website. It also reduces performance in that the username and password cannot be submitted together, so there are more round trips.

However, separating user ID and password may increase usability because it may serve as a mnemonic device, to prompt a user to remember the particular password for this particular account. Furthermore, separating user ID and password increases usability because the user gets immediate feedback if they put in a bad user ID.

What is the latest research on this, or is it a wash?

Thanks,

Sean

---

From: Aaron Parecki <[email-masked]>
Date: Tue, 26 Mar 2019 10:04:58 -0700

Separating the username and password fields enables things like logging in
to an account that doesn't have a password. For example, when I log in to
Google with my company email address, I am redirected to my company's
OpenID server where I enter my password there. I don't have a Google
password for that account. It would be confusing to see a prompt that asked
for my password in Google because nothing I enter there would work, and
more importantly, people would probably enter their company password there
which would be bad.

----
Aaron Parecki
aaronparecki.com
@aaronpk <http://twitter.com/aaronpk>

On Tue, Mar 26, 2019 at 9:47 AM Sean Leonard <[email-masked]> wrote:

> I had a hallway debate earlier today about whether it is better for users
> to be prompted to sign in with separate screens for the username and the
> password.
>
> Example: Google log in flow shows the “Email or phone” prompt first, then
> after that is entered, the password. If the user identifier (email or
> phone) does not match an existing Google account, the error “Couldn’t find
> your Google account” appears. If the user identifier does in fact
> correspond to a Google account, the next screen says “Welcome <userid>” and
> prompts for the password. Other websites and apps may display a user
> picture or other things on the second screen, before the password is
> entered.
>
> The counterexample (which is more common) is the user ID and password are
> asked for on the same screen. The failure response: “either your username
> or password is invalid”, leaves it ambiguous whether the user ID was
> unrecognized, or the user ID was recognized but the password did not match.
> Whether the user ID is valid, can be sussed out depending on how the
> “Forgot password” reset workflow is configured, at the risk of the real
> user getting a notice that an attacker is trying to break into their
> account.
>
> When the user ID and password are separated, it may reduce security
> because an attacker can determine which user IDs are valid or not, and
> thereby narrow their attack. To the extent that the server displays
> user-specific information, security can also be reduced because an attacker
> can copy that cue and use it on a phishing website. It also reduces
> performance in that the username and password cannot be submitted together,
> so there are more round trips.
>
> However, separating user ID and password may increase usability because it
> may serve as a mnemonic device, to prompt a user to remember the particular
> password for this particular account. Furthermore, separating user ID and
> password increases usability because the user gets immediate feedback if
> they put in a bad user ID.
>
> --
> 104attendees mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/104attendees
>

---

From: Olli Vanhoja <[email-masked]>
Date: Tue, 26 Mar 2019 18:12:23 +0100

> When the user ID and password are separated, it may reduce security because an attacker can determine which user IDs are valid or not, and thereby narrow their attack. To the extent that the server…

This is the usual argument and I tend to agree with it. I don't think
anyone else should able to check if I have a Google account or not.

I think majority of the security people are now moving to the mantra
that there should be no password. It used to mean an email login link,
that's actually a bit fake because you login to your email account
with a password and perhaps the link was even sent over Internet
unencrypted. While the link is not typically sensitive in these
systems, it still may enable phishing possibilities. I'm exited to see
whether FIDO2 will get some serious supports.

- Olli

---

From: Olli Vanhoja <[email-masked]>
Date: Tue, 26 Mar 2019 18:17:11 +0100

On Tue, Mar 26, 2019 at 6:05 PM Aaron Parecki <[email-masked]> wrote:
>
> Separating the username and password fields enables things like logging in to an account that doesn't have a password.. For example, when I log in to Google with my company email address, I am redirected to my company's OpenID server where I enter my password there. I don't have a Google password for that account. It would be confusing to see a prompt that asked for my password in Google because nothing I enter there would work, and more importantly, people would probably enter their company password there which would be bad.
>

Right, I missed that case from my previous email. In my opinion this
sort of auth sucks too. In many services you can nowadays create long
chains of delegated authentication and possibly even loops. I
personally can never remember which account I have linked to a service
(or at with point of the chain I need to type a password) and if that
second auth service is actually linked to Facebook or Google, which I
have often done to avoid registering an account with a new password
because I already have hundreds of password.

---

From: Aaron Parecki <[email-masked]>
Date: Tue, 26 Mar 2019 10:21:09 -0700

No, I'm talking about the other way around. Logging in to a Google account
where the *only* option is to sign in via your corporate single-sign-on
server. There's no choice, and there are not multiple ways to log in to
this account. This is a very common pattern with enterprise accounts now,
so that there is only one place your enterprise password lives, and it's
something under the control of your own company rather than in the hands of
every service provider like Google that you use.

----
Aaron Parecki
aaronparecki.com

On Tue, Mar 26, 2019 at 10:17 AM Olli Vanhoja <[email-masked]> wrote:

> > Separating the username and password fields enables things like logging
> in to an account that doesn't have a password.. For example, when I log in
> to Google with my company email address, I am redirected to my company's

---

From: Mukom Akong T <[email-masked]>
Date: Tue, 26 Mar 2019 18:23:41 +0100

> I had a hallway debate earlier today about whether it is better for users to be prompted to sign in with separate screens for the username and the password.

I think that user who take security seriously are using some kind of password manager (it’s built into Safari, Chrome & Opera)
I suspect that separating the prompts will break those (i’ve not actually been asked for credentials across different pages yet so I’m just theorizing.

---

From: Tim Chown <[email-masked]>
Date: Tue, 26 Mar 2019 17:26:17 +0000

Well, that's what eduGAIN provides for the R&E world; access to service provider content via your home organisation credentials; https://edugain.org/

Tim

On 26 Mar 2019, at 17:21, Aaron Parecki <[email-masked]<mailto:[email-masked]>> wrote:

No, I'm talking about the other way around. Logging in to a Google account where the *only* option is to sign in via your corporate single-sign-on server. There's no choice, and there are not multiple ways to log in to this account. This is a very common pattern with enterprise accounts now, so that there is only one place your enterprise password lives, and it's something under the control of your own company rather than in the hands of every service provider like Google that you use.

----
Aaron Parecki
aaronparecki.com<http://aaronparecki.com/>
@aaronpk<http://twitter.com/aaronpk>

On Tue, Mar 26, 2019 at 10:17 AM Olli Vanhoja <[email-masked]<mailto:[email-masked]>> wrote:

[email-masked]<mailto:[email-masked]>

---

From: "Carlos M. Martinez" <[email-masked]>
Date: Tue, 26 Mar 2019 18:26:44 +0100

Hi Mukom,

At least the current Google way of asking for usernames and passwords 
separately confuses password managers a lot, indeed.

/Carlos

On 26 Mar 2019, at 18:23, Mukom Akong T wrote:

>> I had a hallway debate earlier today about whether it is better for 
>> users to be prompted to sign in with separate screens for the 
>> username and the password.
>
>
> I think that user who take security seriously are using some kind of 
> password manager (it’s built into Safari, Chrome & Opera)
> I suspect that separating the prompts will break those (i’ve not 
> actually been asked for credentials across different pages yet so 
> I’m just theorizing.
>
>>

---

From: Olli Vanhoja <[email-masked]>
Date: Tue, 26 Mar 2019 19:12:01 +0100

> No, I'm talking about the other way around. Logging in to a Google account where the *only* option is to sign in via your corporate single-sign-on server. There's no choice, and there are not multi…

Sure but does a regular user see enough difference there to use the
right password at first try? Well maybe they only have one password.

---

From: Sean Leonard <[email-masked]>
Date: Wed, 27 Mar 2019 16:49:19 +0100

> On Mar 26, 2019, at 7:12 PM, Olli Vanhoja <[email-masked]> wrote:
> 

Yeah that is a good question. The topic is research: I would like some research papers, please. :-) Scientific studies and results preferred.

Best regards,

Sean