Take the 2-minute tour ×
Webmasters Stack Exchange is a question and answer site for pro webmasters. It's 100% free, no registration required.

So I've recently been encountering more two step login processes, where I'm required to enter my username on one page and my password on a second. I really don't like this pattern, as it requires an extra page load just to log in.

But I've been told by a couple of people that it is more secure. How is it more secure? Are there other reasons to inconvenience the user with this?

share|improve this question
1  
Security and usability will always be at odds –  John Conde Mar 9 '11 at 16:41
    
sounds like someone has misunderstood what 2 step login actually means –  JamesRyan Mar 9 '11 at 16:48
add comment

8 Answers

up vote 4 down vote accepted

Real two factor authentication introduces another level of security by getting users to login with their username and password and then say a code generated on their phone or via a card/code generator (Barclays Bank sent out card readers that generate a use once code based on your card swipe.

Splitting the username and password on to two different pages doesn't add anything in terms of additional security (AFAIK)

share|improve this answer
    
Yeah, that's what I thought. –  Daniel Bingham Mar 9 '11 at 17:41
    
I hate having to use Barclay's card reader just to log in - so much so that I've closed down the account. –  John Catterfeld Apr 14 '11 at 8:21
    
I feel your pain John. It was worse when they insisted you use one but hadn't actually sent one out to me. That was great... –  Digital Essence Apr 14 '11 at 9:00
add comment

The only reason that I've seen the two step login as you describe it be more secure is if the username entered on the first page is matched to some sort of image or phrase that the user chooses when they register. This helps the site verify itself.

If someone were to copy your site to use in a phishing campaign, they wouldn't be able to display the image or phrase. It protects the user when they enter their password.

If you are not pulling up any additional account security items from the first page to the second, then there isn't much point to doing it that way.

share|improve this answer
    
True, but this can also be done with a single page and a cookie-based approach, as seen with the Yahoo sign-in page. –  Jacob Hume Mar 9 '11 at 19:13
1  
The cookie based approach doesn't handle signing in on a different computer. Site such as bank sites want protection even if you don't have cookies set. It's over kill for most sites though. But that's the reasoning behind it. –  lovefaithswing Mar 9 '11 at 20:49
add comment

The only reasoning I can come up with involves preventing automated attacks.

Where the username and password are both accepted on one page, it's relatively simple to create an automated script that will hammer that page with username and password combinations until something gets through - called a "Brute force" attack, for obvious reasons.

Having your username entered on one page and your password entered on another page would make this sort of attack more difficult, but not impossible. It would do a nice job of keeping out simple attackers, and put you ahead of the majority of sites.

While you're not technically more secure than your neighbor, you're not one of the low-hanging fruit anymore.

share|improve this answer
add comment

This is kind of a weird case, but if the main site is served unencrypted (for performance reasons probably), but you want users to be able to start the login process from that page, instead of clicking on a "log in" link. Sending your user name unencrypted isn't a big deal, and then you could serve the second part of the login page (the password field) over HTTPS.

I think it's probably not worth it (more work for programmers, more work for users, tiny tiny decrease in processor work load), but some people might think it's worthwhile.

Example: First National does this on their home page.

share|improve this answer
add comment

I could only find this older documentation about it, http://www.schneier.com/blog/archives/2005/10/us_regulators_r.html. Long story short US Banks and I believe Credit Card companies are required to use two-factor authentication for their website log in forms.

As the post discusses it doesn't really solve the problem, it just makes criminals have one more hoop to jump through.

share|improve this answer
1  
The question isn't describing two-factor authentication.. –  Brendan Long Mar 9 '11 at 20:01
    
@Brendan - The document is old. I wish I could find the most current version. I worked for a web company in 08/09 that did credit card processing and I am not sure where the rule came from but develop had to create two-factor authentication in order to comply with a federal guideline. I wish I could find the source. If I do, I will add a link to it. –  RandomBen Mar 9 '11 at 20:58
1  
What I mean is that you're talking about two-factor authentication, but that's not what the question is asking about. The question is about a two-step login page that asks the same information as usual (user name on the first page, password on the second). –  Brendan Long Mar 9 '11 at 22:17
add comment

Accepting username and password on seperate page does not make the application more secure in any way whatsoever. I'm interested in knowing which website(s) did you encounter this on?

share|improve this answer
add comment

My Bank found a very good reason to use two-step authentication: They've got 3 methods of authenticating users that I know of:

  • Crypto card for companies
  • Crypto card for private accounts (different kind of card!)
  • Password-only authentication

They use two-step login so they know the kind of account you've got so they can offer some assistance when entering the password. If you need to enter a password they clearly ask for a password. If you need to use your crypto card to generate a unique authentication code they ask for the code and provide a help link specific to your kind of card.

share|improve this answer
add comment

I would say it makes it less secure. Because you can then know that user123 has an account on the site, and then you can do a brute force on that account.

Standard practice is to never to let people know if the account or password is incorrect .. "you entered an incorrect username or password"

making it a lot harder to brute force.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.