It is usually worse for users using a password manager, since some of them will not be able to detect/autofill the password field on the second page. But I haven't checked, maybe Kratos UI is supported by all major password managers and this is not an issue here.
Since the parameter is called "enable_legacy_flow", does it mean it will be removed in future releases?
[Username] Visible
[Password] Hidden
[Next] Button Clicked
|
V
Server checks username and user type (password case)
|
V
[Username] Read Only
[Password] Visible, with any previously submitted value
[Login]
Similarly for account registration, with a hidden username field and a visible password field if separating the password and account initial entry.Just my own experience with a lot of experiments on implementing an authentication system and supporting a password manager for self-serving purposes.
> It is usually worse for users using a password manager, since some of them will not be able to detect/autofill the password field on the second page. But I haven't checked, maybe Kratos UI is supported by all major password managers and this is not an issue here.
The two-step flow is currently only implemented for registration, so autofill should not be a concern. However, we surely want to inform the password manager to store the correct password after registration.
Do you think https://developer.mozilla.org/en-US/docs/Web/API/Credentials... is the correct way to inform a password manager?
> Since the parameter is called "enable_legacy_flow", does it mean it will be removed in future releases?
In general we perceive the two-step registration as an UX improvement when you have multiple credential strategies, which previously would generate a long registration form with repeated fields. However, we have no plan to remove the config value in the forseeable future.
The out-of-the-box UI is support by all major pw managers, but you do need to click twice (once for username/once for password)
Has the process around customising the UI improved recently? That was by far the biggest pain point for me when setting it up.
It costs nothing (unlike SMS) so I'm not sure why Auth0 wants to charge $240+/month just to get basic 2FA.
LOGIN UX has become very confusing. Users have been vendor locked down. Since windows and mac and linux users have to deal with multiple key management which isn't ideal.
In my opinion, it isn't any more secure over mfa.