One sign-in for every Rutba site, and why it asks for your address first

Until recently, signing in to Rutba depended on which site you were on. Four of the six Rutba sites had never heard of a session and showed a "Sign in" button to everybody, including somebody who had signed in a minute earlier on the site next door. The other two had login forms of their own, which made them the third and fourth places in Rutba collecting a password.

Every one of those places is somewhere a password can be phished, stored wrongly or leaked. The fix was not six better login forms. It was one.

One front door

Every Rutba site now signs in through a single front door. The site sends you there, you sign in, and you come back already signed in, with your name shown, and a launcher that lists everything your account can actually open. None of the six sites has a login form any more.

Each site still keeps its own session, under its own name, rather than one cookie shared across every Rutba address. That is deliberate: a cookie shared across the whole domain would also be sent to every customer’s own instance of the software, which is exactly where it should never go.

Why it asks for your address first

The front door opens with a single field: your email address. No password box. That surprises people, so it is worth explaining, and the reason is the most important design decision in the whole change.

When we built it, a business running Rutba for its staff had its own sign-in in its workspace, and its people’s passwords were checked there. So the front door could not always check a password (it was not always the place that held it), and a password box on the first screen would have had to reject passwords that were correct. It asked for the address, looked up where that address belonged, and handed you on.

A live workspace and a test one, told apart

A company might have a live workspace and a test one, used by the same people with the same email addresses, and an address alone cannot tell them apart. They are two entries in the same list: the switcher in every app’s header says which one you are in, a demo or test workspace carries a mark that stays on screen, and nothing about which one you are in is ever carried in a link.

Several organisations, one person

An accountant working for three clients, or a partner supporting several customers, belongs to more than one organisation. The switcher moves them between them in one click, with no second password, and a person is given access to things like the Relay through their membership of an organisation, not by creating another account.