11–20 of 170 posts
Even if this doesn’t increase security, you should still do it in the hope the user will check the username they’ve just typed as well as retyping the password.
Why? Why not just tell the user what is actually wrong?
Even if this doesn’t increase security, you should still do it in the hope the user will check the username they’ve just typed as well as retyping the password.
Why? Why not just tell the user what is actually wrong?
Earlier quoted context omitted.
Why? Why not just tell the user what is actually wrong?
Because the application doesn't know what is actually wrong. The error message is actually correct as written. The user entered their username incorrectly or their password incorrectly, or both. The application doesn’t know which and shouldn’t guess!
Even if this doesn’t increase security, you should still do it in the hope the user will check the username they’ve just typed as well as retyping the password.
Why? Why not just tell the user what is actually wrong?
Not accusing you BTW.
The article explains how to do it properly at the end: > To prevent attackers from knowing whether an account exists or not your signup must only take an email address and provide no feedback in the UI if the sign up succeeded or not. Instead the user would receive an email saying they’re signed up. Is this not also part of the various 'best practices'? (I confess I don't read too many of them!)
Where it gets really interesting is when you perform user enumeration attacks via timing. IE: it takes the server a few milliseconds longer to send a registration email than to not, or it takes the server longer to try to validate a password hash than to lookup a nonexistent user.
Even if this doesn’t increase security, you should still do it in the hope the user will check the username they’ve just typed as well as retyping the password.
Why? Why not just tell the user what is actually wrong?
1. Email and password for login. Don't tell the attacker which is correct.
2. Email and password for registration. On registration send confirmation email. If user is already register attacker would need access to their email. Access to email is game over.
So now an attacker can't see which users are registered with your service and you've protected your customers privacy.
Extra points if your code is aware of timing attacks.
Earlier quoted context omitted.
Because the application doesn't know what is actually wrong. The error message is actually correct as written. The user entered their username incorrectly or their password incorrectly, or both. The application doesn’t know which and shouldn’t guess!
Why wouldn't the application know?
You could provide the correct password to your account 'test', but not 'ttest'.
The server just tells you to check both instead, it's more semantically correct and offers some security improvements with user enumeration.
Earlier quoted context omitted.
Because the application doesn't know what is actually wrong. The error message is actually correct as written. The user entered their username incorrectly or their password incorrectly, or both. The application doesn’t know which and shouldn’t guess!
Why wouldn't the application know?
Earlier quoted context omitted.
Why? Why not just tell the user what is actually wrong?
Because it allows attackers to look for accounts. It's part of your privacy that I shouldn't be able to see if you have an account with sexycatpictures.com Not accusing you BTW.