- use standard input field names password managers recognize - disable autocompletion and autocapitalization on the login field
- if it's an email, use the correct HTML5 input type
- don't have a form with just a login email and force the user to click to enter the password
- follow NIST SP 800-53, e.g. no SMS 2FA and no arbitrary password rotation and composition rules
Or how many sites that have a form with only one input don't automatically focus on it.
https://adamsilver.io/blog/form-design-from-zero-to-hero-all...
He has posted many new things since. Probably one of the best UX resources on the web.
This is required for any non trivial auth system though. You not know until the user is submitted if that user has a password or is using something else.
We're trying to authenticate a pair: user/pass.
That's one example where the "web stack" expects every single website to implement things manually that were standard in native UI toolkits. Then of course the majority of websites will not deem it a priority or not realize it's a thing to consider at all - and we end up in a situation like this.
I was noticing that this kind of login forms seems to be proliferating, especially on "big tech" sites. (And personally, I also find it annoying)
Always assumed there was some reason why sites are switching to this pattern, e.g. better bot protection. Does anyone know more about this?
That's reasonable to do when that form is the reason a page exists but otherwise it's best to not mess with the user's focus.