Hey Dargo,
I started using "1password 4" password vault which is a password management program and I wanted to save my Kraken credentials there. On the login screen Kraken asks for username, password and 2fa token all on the same screen, but because the 2fa token changes quickly the password vault doesn't work because it only stores one value for the 2fa field. Other sites prompt for username and password on the login screen and then load a second screen asking for 2fa token if the user has 2fa enabled. Is there any chance you could chance the login process do like that? One screen to prompt for username and password and a separete screen after for 2fa token?
Anyone else like this idea or is it only me?
Is there a reason the 2fa token field is included on the login screen? Was that just for convenience?
Peace.
It sounds like you got this sorted out. But to answer your question, the advantage of having all login credentials on one screen is that it doesn't imply any information about what part of the login credentials are wrong on a failed login attempt - say for an attacker trying to gain access to your account. Having a separate screen for 2fa implies that you've entered the correct username and password if you make it to the 2fa screen.
Of course, we could make it so you get the 2fa screen even if you don't enter the right username and password (and maybe other sites do this). But the problem with doing it this way is that legitimate users who are having trouble logging in will still tend to assume that they've entered the correct username and password if they make it to the 2fa screen, which will be an obstacle to trouble-shooting the problem if they are having trouble.
I'm not familiar with the "1password 4" management application, but if it can generate 2fa, this is a feature that shouldn't be used anyway. The whole point of 2fa is that you need control of a second device (or at least a second application). It's not as secure to have a system where anyone who gains access to your password manager will have all your login credentials. Even if the application is just letting you enter your 2fa from another device through it, I don't think I'd do this - I'd rather keep my 2fa completely separate from the password manager so the 2fa is a completely separate credential channel.
The approach you arrived at is probably best from a security standpoint, even if it's a little less convenient.