Show HN: iOS Login Page(github.com)
github.com
Show HN: iOS Login Page
https://github.com/realpaliy/ios-login
39 comments
After thinking about it more, maybe I am wrong and there is a use case for these animations:
Small children like to look at moving things.
So it depends on the target audience. Toys or educational Apps are different from the business / financial context implied in your demo.
Small children like to look at moving things.
So it depends on the target audience. Toys or educational Apps are different from the business / financial context implied in your demo.
Don't underestimate the number of successful adults who treat their finances / business as a toy
There is a trend of infantilization within modern culture. This has been underway for some time now.
You are right, I found more on this:
https://www.uta.edu/huma/agger/fastcapitalism/10_1/bernardin...
https://www.uta.edu/huma/agger/fastcapitalism/10_1/bernardin...
That is beautiful! One thing I've noticed tho from some of my older users is that they have no idea what the difference is between "login" and "sign up". I'm sure there's a better way to present that, but I haven't figured out how so far.
It is beautiful and it's a tough problem to solve--the login/signup is a big cause of friction and confusion to users.
I would wonder how many users notice the "Sign Up" link or read it as "Sign In" and not understand how to proceed.
The distinction between username and email is lost on a lot of people, unless you expect accounts to outlive emails and the value of having an account is worth this friction (think Dropbox or online banking) then use an email or phone instead.
I do wonder if for most apps a two-step process is easier: enter your email/phone to continue, if that exists ask them to logon or otherwise create an account. I realize there are concerns about account enumeration, which are valid, but end up being overly hostile to the user (plus most registration flows leak anyway).
I would wonder how many users notice the "Sign Up" link or read it as "Sign In" and not understand how to proceed.
The distinction between username and email is lost on a lot of people, unless you expect accounts to outlive emails and the value of having an account is worth this friction (think Dropbox or online banking) then use an email or phone instead.
I do wonder if for most apps a two-step process is easier: enter your email/phone to continue, if that exists ask them to logon or otherwise create an account. I realize there are concerns about account enumeration, which are valid, but end up being overly hostile to the user (plus most registration flows leak anyway).
Thats a good idea! I might try that.
Visiting my mother-in-law the other day I helped her with a TV on demand "app" built into her TV. For some reason it needed her to log in again and she was stuck. She had successfully entered her email and password (I was surprised and impressed), but had absolutely no inkling of the final step required - moving the pointer to the button marked "login" and pressing it. So easy to forget that a tech-centric mental model can be completely alien to "normal" people, especially older people.
Maybe wording that explains better what each of them does? Like "Create a new account" and "Log into my account"?
Wouldn't fit in the UI as designed unless you broke each button into two lines though.
Wouldn't fit in the UI as designed unless you broke each button into two lines though.
My head always struggles with "Sign up" and "Sign in"...best example for me - https://www.digitalocean.com [1]
[1] https://i.imgur.com/fAS7rfz.png
[1] https://i.imgur.com/fAS7rfz.png
Step 1: ask user to enter their email.
Step 2: if that email exists in the database, ask for password. Otherwise confirm with the user that they are new to the site. Then ask for password twice.
Step 3: done.
Step 2: if that email exists in the database, ask for password. Otherwise confirm with the user that they are new to the site. Then ask for password twice.
Step 3: done.
Yep, this user flow bifurcation is nothing but confusing for people.
I avoid it and have found people are far less confused
I avoid it and have found people are far less confused
helpful mnemonic for remembering the difference between "log in" and "login": "I'm going to log in on the login page"
On iOS the phone gifs are comically long.
It’s a pretty animation... so nice work on that front.
Regarding login in general, people are done with passwords. From a security perspective they are worthless in most situations. From a user perspective, no one wants to make a new one or remember a different one, so they reuse them.
The good thing is this greatly simplifies the flow.
1) Ask for the email address. 2) check it against your system 2a) user found -> send auth email link 2b) no user, make a new one
Done. 2 steps, no passwords, no double path / flow
Regarding login in general, people are done with passwords. From a security perspective they are worthless in most situations. From a user perspective, no one wants to make a new one or remember a different one, so they reuse them.
The good thing is this greatly simplifies the flow.
1) Ask for the email address. 2) check it against your system 2a) user found -> send auth email link 2b) no user, make a new one
Done. 2 steps, no passwords, no double path / flow
I think that's rather bold to say "people are done with passwords." Personally, I find them rather annoying. I don't like bouncing between apps. The email login link often opens a new tab/window, too. When the email doesn't show up immediately I question what one of five things could have gone wrong? Is it my fault or their's?
I also can't see how this would be more secure (outside of knowing they reuse the same password everywhere). If they hijack your e-mail they login without warning since that's the normal flow. If they use your email to reset your password, both the service and the user get informed there was abnormal access.
I also can't see how this would be more secure (outside of knowing they reuse the same password everywhere). If they hijack your e-mail they login without warning since that's the normal flow. If they use your email to reset your password, both the service and the user get informed there was abnormal access.
Sorry... people ‘should’ be done with them, but that is my bias towards security.
Your email is probably linked with just about everything you do. I would suggest you ensure it has a 16 character random password with 2 factor auth. If someone gets in, they own everything so treat it accordingly.
Also, what apps beyond banking or health do you log out of?
Your email is probably linked with just about everything you do. I would suggest you ensure it has a 16 character random password with 2 factor auth. If someone gets in, they own everything so treat it accordingly.
Also, what apps beyond banking or health do you log out of?
Accounts just seem to accrue. My password manager has over 500 items. I tend to uninstall phone apps I don't use after a few months and reinstall them as needed. I also hop between a computer and phone and iPad or between app and website, each requiring me to login again.
I also appreciate being able to log into an account on an untrusted computer without having to log into my email.
I also appreciate being able to log into an account on an untrusted computer without having to log into my email.
I see many problems with that:
- if you change your email address, or have any problem with it (oups, google has blocked you again!), you can't log in. Have been bitten by this when myopera.com closed and I couldn't access my old email. I lost some accounts.
- emails are clear text, so bots can intercept a login link and use it
- if you want to share the account with somebody, you gotta give them access to your email
- I don't want my inbox to be polluted by 15 login email every day
- using my password manager is much faster than doing this
- if you change your email address, or have any problem with it (oups, google has blocked you again!), you can't log in. Have been bitten by this when myopera.com closed and I couldn't access my old email. I lost some accounts.
- emails are clear text, so bots can intercept a login link and use it
- if you want to share the account with somebody, you gotta give them access to your email
- I don't want my inbox to be polluted by 15 login email every day
- using my password manager is much faster than doing this
We always include a backup code in the email you can manually paste in.
Do you need to login to things repeatedly? I mean, sure your bank... but what else do you log out of?
You and I use a password manager... but are they mainstream? My parents sure dont
Do you need to login to things repeatedly? I mean, sure your bank... but what else do you log out of?
You and I use a password manager... but are they mainstream? My parents sure dont
> We always include a backup code in the email you can manually paste in.
It's going to help me with any of that. Can't access backup code if email is closed. Won't prevent bot from stealing the account. Won't help me with sharing the account, I'm not going to give the backup code to the person every time they need to login.
> Do you need to login to things repeatedly? I mean, sure your bank... but what else do you log out of?
Banks. Stuff for which you have several accounts on the same service (I have 11 email accounts, 4 github accounts, 3 HN accounts, 3 reddit accounts). A lot of people have at least 2 fb accounts, one official and one personal, and most of them don't know about browser containers.
> You and I use a password manager... but are they mainstream? My parents sure dont
No, and I expect they will never be. Auth is not a solve problem.
But email links are not the solution. At best, one login option, and a good way to start off.
Password auth should always be offered. It's the most neutral, balanced, resilient, privacy friendly, interoperable stuff we have for now.
It's going to help me with any of that. Can't access backup code if email is closed. Won't prevent bot from stealing the account. Won't help me with sharing the account, I'm not going to give the backup code to the person every time they need to login.
> Do you need to login to things repeatedly? I mean, sure your bank... but what else do you log out of?
Banks. Stuff for which you have several accounts on the same service (I have 11 email accounts, 4 github accounts, 3 HN accounts, 3 reddit accounts). A lot of people have at least 2 fb accounts, one official and one personal, and most of them don't know about browser containers.
> You and I use a password manager... but are they mainstream? My parents sure dont
No, and I expect they will never be. Auth is not a solve problem.
But email links are not the solution. At best, one login option, and a good way to start off.
Password auth should always be offered. It's the most neutral, balanced, resilient, privacy friendly, interoperable stuff we have for now.
Thanks for sharing, lots of good thoughts.
I definitely don’t use this method for security conscious content / apps. Mostly for simple stuff with minimal to no private content.
I definitely don’t use this method for security conscious content / apps. Mostly for simple stuff with minimal to no private content.
Also... can you expand on ‘bots can intercept a login link?’
You would have to be actively engaged with a ‘man in the middle’ for this to be an issue. Am I missing something.
You would have to be actively engaged with a ‘man in the middle’ for this to be an issue. Am I missing something.
Same reason people push for HTTPS everywhere.
Passwordless is great until it's not. You tend to need to be on same device / browser as your email for it to work seamlessly. It also adds mental debt, in that many multiple actions are required to proceed (personally find myself with irrational logout fear thanks to this).
Appreciate it seems like it answers all the questions but I think, in the end, it talks more to the developer than the user.
I say this as a major proponent of smarter 'dumb' auth, an earliesh adopter with passwordless, plus having run it as the primary login mechanism on a site with 25-150 new signups / day for nearly three years.
Looking forward to more widespread adoption/availabilty of webauthn, embedded (consumer) security features, etc.
Appreciate it seems like it answers all the questions but I think, in the end, it talks more to the developer than the user.
I say this as a major proponent of smarter 'dumb' auth, an earliesh adopter with passwordless, plus having run it as the primary login mechanism on a site with 25-150 new signups / day for nearly three years.
Looking forward to more widespread adoption/availabilty of webauthn, embedded (consumer) security features, etc.
A password manager is way faster. It's just one tap.
The email flow is slower. I need to switch apps, wait for the email, open it, click on the link.
The email flow is slower. I need to switch apps, wait for the email, open it, click on the link.
From a simplicity perspective, I'd prefer a text message with a 6-10 character numeric code that can be auto filled with one tap.
Aka the Lyft model (they probably didn't come up with it, but they're the main example that I can think of off the top of my head).
Aka the Lyft model (they probably didn't come up with it, but they're the main example that I can think of off the top of my head).
Sure... text is fine but easier to hack typically. For low sensitivity, it is probably faster than email.
Also, you can check out my recent post about my messenger, which presents another design of iOS Login Page. https://news.ycombinator.com/item?id=22516065
Nice work! Thanks for sharing.
Whatever, as long as they support the password manager.
I think there is a reason why it's dark when the stage set of a theatre is being changed between scenes, but with user interfaces somehow any rearrangement must be a distracting visual gimmick these days.
Edit: Seriously, why do you need a hard change to a blue background only to then move a white cloud up across nearly the complete height of the screen?
https://github.com/realpaliy/ios-login/raw/master/art/finalA...