Google latest sign-in update is making a lot of people very angry

https://productforums.google.com/forum/m/#!category-topic/gmail/oAsE-6wmaSU

by superasn • 11 years ago

24 28 11 years ago

productforums.google.com

fweespeech• 11 years ago

As we’ve said many times, we're working towards introducing new authentication solutions that complement traditional passwords. We’ve already separated the ‘username’ and ‘password’ fields onto separate pages on a successful launch in Android last year. This change to our web sign-in page is another step in that direction.

It may make them angry but its pretty clear Google is working towards a:

"Username" -> "Auth Factor 1; Maybe not Password" -> "Auth Factor 2; Also maybe not Password" model.

jeffjose• 11 years ago

Why cant we have both? Like the 2FA?

Have the users enter their user/pass in the first page. The second and third pages then asks the Auth Factor II or Auth Factor III fields

fsk• 11 years ago

Couldn't they accomplish the same effect with AJAX? I.e., display the 2nd bit based on which E-Mail is typed?

jtagen• 11 years ago

I've never understood the security benefit to having separate username/password pages. How does this help?

ucaetano3• 11 years ago

It prevents someone from faking Google's login page (or any other service) to capture users' passwords. This is the same as showing a "trusted image" that you selected.

apendleton• 11 years ago

Does it? What stops them from MITM-ing your answer on the first screen to get the trust image for the second screen? (In a way that's meaningfully different than the single-screen version, I mean, so not HTTPS certs.)

superasn• 11 years ago

I think the biggest problem with their new sign-in which most people are having is that it is more time consuming, i.e. two steps means clicking the sign-in button twice, waiting for transition between pages.

Secondly, it breaks almost all password managers including Lastpass, and it breaks a lot of extensions like these[1]

[1] https://chrome.google.com/webstore/detail/quick-login-for-go...

nav12• 11 years ago

That's not true, though. You would still have to either press tab (now enter), or click the second field to enter the password.

Veratyr2• 11 years ago

It's very true. The click isn't the problem, the "waiting for transition between pages" is the problem.

Type username/password = ~1s each

Single keypress = ~0.1s each

Page load = ~2s

Before: username + tab + password + enter = 1 + 0.1 + 1 + 0.1 + 2 = ~2.2s

After: username + enter + page load + password + enter = 1 + 0.1 + 2 + 1 + 0.1 + 2 = ~4.2s

Roughly doubling the amount of time it takes to enter your information is significant and annoying.

hullo• 11 years ago

Would Google consider breaking Lastpass a bug or a feature?

infogulch• 11 years ago

I don't know how they could consider it a feature. If someone is using lastpass, that person is probably many times more security-conscious than their average user.

Akteivias• 11 years ago

I have no problems with Dashlane

nosideeffects4• 11 years ago

Google is in a transition to optimize for your account security over the convenience of saving 500ms every week or so by having a single page.

For the business "this is wasting my time" complaint I just read a whole lot of: you're about to spend an hour or so reading inconsequential emails instead of doing anything productive anyways. What is another 500ms?

benstein• 11 years ago

Bank of America has had 2-part login screens forever. IIRC they are going in the opposite direction and will be putting them together in a single page very shortly.

gohrt2• 11 years ago

Right, because if one day your sitekey is missing, you'll shrug and think "I guess my cache cleared, whatever", and not distinguish a data reset from a MITM attack.

ic-junk2• 11 years ago

Every spammer will now know the full name of any google user since it's displayed on the second page. Eventually in the near future, even if you remove the name and keep the display image and the display image is of a person, face recognition software could determine who the person is due to Facebook and other social media platforms. Displaying a display image or showing the full name is a complete breach of security and privacy. Eventually one could theoretically find all Google accounts a person has with Google.

nosideeffects4• 11 years ago

I thought it only showed this information if you had recently, successfully logged in to your account on that computer?

ic-junk2• 11 years ago

Yeah I suppose that is possible if they didn't spoof it or your device becoming compromised. I haven't seen/read anything on what they're doing to handle this scenario.

Google latest sign-in update is making a lot of people very angry

Related Stories