Hacker News new | ask | show | jobs
by kylecordes 3609 days ago
I'm really looking forward to an answer for us, if someone with deep and relevant knowledge is around. There are a couple of possibilities that come to mind:

1) Perhaps testing reveals that some users are pushed away by the complexity of being confronted with two fields at the same time, and these users are more likely to successfully login presented with only one field at a time.

2) Perhaps there is some actual good security reason for it.

3) Perhaps there is some bad security reason for it. First example, lots of sites appear to express a belief that password managers are evil, and that users must be forced by increasingly obstinate means to type each long detailed robust password one single character at a time. Maybe this is simply an extension of that somehow.

4) Perhaps a security standard somewhere was devised that for some reason (good or bad) demanded this behavior; then it has been copied across the industry ever since.

2 comments

#3! God it pisses me off so much that Google does this now. I have about 6 different Google accounts (one GApps for Ed, two personal, and three GApps for Business) and it's a pain since I use LastPass, and LP doesn't always get the user matched right. I have to select the right one twice!
Could you explain how "password managers" are a good idea?

I can't seem to grasp the concept, or what makes it more secure to have one password for all your passwords and/or to store all your login credentials on someone else's computer.

Easy: I currently have 619 unique passwords, all but two auto-generated and difficult to memorize (because they tend to be 40+ characters and as random as practical). I've had at least four websites on which I've had an account experience publicly-known hash leaks, and in zero of those cases, nor any future cases, is my password hash likely to be easily cracked, and in the unlikely event that it is, the combination or username/email + that password doesn't work anywhere else, so it's of little to no value.

I use 1Password, though, so I'm not storing my passwords on someone else's computer in the same way LastPass does.

The ease with which password hashes are cracked advances steadily, and I wish more sites would let me supply them with 80+-character passwords.

> the complexity of [...] two fields

If that is true the world is doomed. Giant Meteor 2016

I... I mean... these fuckers can drive, right? They pilot tonne-weight vehicles, at speed, amongst peers. And some of them are responsible for running the power grid, the government, food production, a bunch of other important stuff. They can hold a conversation with another sapient being, and yet a form with two fields is supposedly too much for their minds to deal with?

I don't buy it.

A 1% conversion rate increase for some companies is worth millions.
No. Some users cannot drive.
My point is that these are intelligent beings, capable of doing all sorts of amazing things.

We can't presume that our users are no more than slavering beasts, incapable of understanding even the simplest things.

Not all people are visual thinkers or have large visual bandwidth.

Also, if asking one question at a time adds a % or two to the user base of something as big as Google, then that's a lot of new users.