https://adamsilver.io/blog/form-design-from-zero-to-hero-all...
He has posted many new things since. Probably one of the best UX resources on the web.
This is required for any non trivial auth system though. You not know until the user is submitted if that user has a password or is using something else.
We're trying to authenticate a pair: user/pass.
I think what some sites do is have a visually hidden, not required password field that a password manager can fill in. If it's not a password-based auth, the flow goes to the next step but if it is, it reveals the password field which may already be filled in.
Username enumeration isn't usually considered a vulnerability, but it does make other attacks, like credential stuffing, easier. I.E. you can focus attack resources on usernames that have active accounts.
It's very low on my list of concerns though, usually there's much worse problems when I pentest.
That's one example where the "web stack" expects every single website to implement things manually that were standard in native UI toolkits. Then of course the majority of websites will not deem it a priority or not realize it's a thing to consider at all - and we end up in a situation like this.
I was noticing that this kind of login forms seems to be proliferating, especially on "big tech" sites. (And personally, I also find it annoying)
Always assumed there was some reason why sites are switching to this pattern, e.g. better bot protection. Does anyone know more about this?
But yeah, nowadays it's mostly SSO, I assume. Which is still annoying as on the SSO site I have to enter my mail address again (or rather: have my password manager doing it ;) ), which is an inconvenience and where I wonder how much of that is to collect data about companies where employees would like to use the service for having sales reaching out. In many places (like Slack or Zoom) company is picked by domain name (yourcompany.slack.com etc.) and then leading to the right SSO.
That's reasonable to do when that form is the reason a page exists but otherwise it's best to not mess with the user's focus.