One sign-in for every Rutba site, and why it asks for your address first

Until recently, signing in to Rutba depended on which site you were on. Four of the six Rutba sites had never heard of a session and showed a "Sign in" button to everybody — including somebody who had signed in a minute earlier on the site next door. The other two had login forms of their own, which made them the third and fourth places in Rutba collecting a password.

Every one of those places is somewhere a password can be phished, stored wrongly or leaked. The fix was not six better login forms. It was one.

One front door

Every Rutba site now signs in through a single front door. The site sends you there, you sign in, and you come back already signed in — with your name shown, and a launcher that lists everything your account can actually open. None of the six sites has a login form any more.

Each site still keeps its own session, under its own name, rather than one cookie shared across every Rutba address. That is deliberate: a cookie shared across the whole domain would also be sent to every customer’s own instance of the software, which is exactly where it should never go.

Why it asks for your address first

The front door opens with a single field: your email address. No password box. That surprises people, so it is worth explaining — and the reason is the most important design decision in the whole change.

A business that runs Rutba for its staff has its own sign-in. Its people’s passwords are checked there, by the organisation’s own system, not by us. So the front door frequently cannot check your password — it is not the place that holds it. If it showed a password box on the first screen, it would have to answer "that did not work" to a password that was correct.

Instead it asks for your address, works out which organisation’s sign-in that address belongs to, and hands you on. For those people, the front door never sees their password at all. For Rutba’s own accounts, it shows the password field itself.

A password box on the first screen would have to reject a correct password, because this door is often not the one that checks it.

Where you came from beats what your address says

Working out which sign-in you belong to has one subtlety. A company might have a live system and a test system, and the same people use both with the same email addresses. The address alone cannot tell them apart — it would send everybody to whichever one was recorded, and the other would be unreachable.

So the site you started from counts first. Arriving from the test system is a statement about where you want to be; an email domain is only a guess. The address decides when the starting point does not.

Several organisations, one person

An accountant working for three clients, or a partner supporting several customers, belongs to more than one organisation. The launcher lets them switch between them — and a person is given access to things like the Relay through their membership of an organisation, not by creating another account.