News for hackers. Stuff that matters.
Re:Don’t Get Clever with Login Forms by cr0sh on Friday February 15, 2019 @06:18PM (#19175673)
Maybe I'm not following things right, but instead of doing it this way, why not have the screen with email and password (and whatever else - forgot password, submit button, etc) - but have the screen do the check on the email - and if the flow is different, change the screen (remove fields, change labels, etc), or redirect to a new screen?

That way, those that use password managers could still continue so (as it would check and see that yes, password flow - or whatever), but for others, it would do something else.

Re:Don’t Get Clever with Login Forms by underwater on Friday February 15, 2019 @09:31PM (#19176639)
Imagine a real world equivalent: a store that loudly states "Membership card needed for purchase", but in actual fact have massive exceptions if you do try and purchase without a membership. This wouldn't be a smart business decision (how many non-members do you know who fill their prescriptions at Costco).
Re:Don’t Get Clever with Login Forms by swiftcoder on Saturday February 16, 2019 @12:02AM (#19177170)
The password field in this scenario doesn't have to be visible. As long as it's attached to the DOM the password manager can still fill it. Then you make the password field visible if the email address doesn't match a known SSO integration.
Re:Don’t Get Clever with Login Forms by underwater on Saturday February 16, 2019 @07:18PM (#19181822)
That is good advice. And I would get behind Brad promoting that as a design pattern.