Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

“Username or password is incorrect” is bullshit

hackernoon.com

Post reply on HN
Print view View original

21–30 of 170 posts

Re: “Username or password is incorrect” is bullshit

#21

Post by aglionby »

willvarfar wrote: post #6

The article explains how to do it properly at the end: > To prevent attackers from knowing whether an account exists or not your signup must only take an email address and provide no feedback in the UI if the sign up succeeded or not. Instead the user would receive an email saying they’re signed up. Is this not also part of the various 'best practices'? (I confess I don't read too many of them!)

I've once tried to sign up for some site (I can't remember which) which went through with the usual successful signup, please check your email text. The email I received however was something along the lines of 'you already have an account with this email!', which seems like the best way of doing things.

Re: “Username or password is incorrect” is bullshit

#22

Post by 1ba9115454 »

aninhumer wrote: post #20
1ba9115454 wrote: post #14

Earlier quoted context omitted.

Because it allows attackers to look for accounts. It's part of your privacy that I shouldn't be able to see if you have an account with sexycatpictures.com Not accusing you BTW.

Read the article. It's debunking that exact argument.

You read the article. Author backtracks at the end.

Re: “Username or password is incorrect” is bullshit

#23

Post by aglionby »

tuxxy wrote: post #15
willvarfar wrote: post #6

The article explains how to do it properly at the end: > To prevent attackers from knowing whether an account exists or not your signup must only take an email address and provide no feedback in the UI if the sign up succeeded or not. Instead the user would receive an email saying they’re signed up. Is this not also part of the various 'best practices'? (I confess I don't read too many of them!)

Typically, yes. This post didn't really offer any new insight to this. Maybe it's a PSA? Either way, it completely depends on the site's threat model. In the case of GitHub, it's quite useless because a user can just go to the targets's profile to see if it exists. Thus, it really isn't in GitHub's threat model, obviously. Where it gets really interesting is when you perform user enumeration attacks via timing. IE: i…

Is this possible to detect despite external factors (variable latency etc)?

Re: “Username or password is incorrect” is bullshit

#24

Post by gaius »

bolololo1 wrote: post #19
kalleboo wrote: post #13

Earlier quoted context omitted.

Why wouldn't the application know?

The application knows unless it some app written by someone who is starting with programming.

How can it? It passes the pair to some auth API and gets just a yes or a no back.

Re: “Username or password is incorrect” is bullshit

#25

Post by IshKebab »

yoodenvranx wrote: post #16
basdp wrote: post #10

Earlier quoted context omitted.

Why? Why not just tell the user what is actually wrong?

Assume a site has two accounts "user122" and "user123". When a user logs in with "user122" and a password and it does not work: What happened? Did the user mistype the password or the username?

Assume a user got their username or password wrong. What is more likely, they got their username wrong in a way that happens to be the same as another user, or they got their password wrong?

Re: “Username or password is incorrect” is bullshit

#26

Post by IshKebab »

tuxxy wrote: post #18
kalleboo wrote: post #13

Earlier quoted context omitted.

Why wouldn't the application know?

The application doesn't know if the username you entered is actually yours or someone else's. You could provide the correct password to your account 'test', but not 'ttest'. The server just tells you to check both instead, it's more semantically correct and offers some security improvements with user enumeration.

It knows if it doesn't exist though. This whole thing is about sites that say "Username or password is wrong" when they know the username is wrong because it doesn't exist!

Re: “Username or password is incorrect” is bullshit

#27

Post by chrisper »

bolololo1 wrote: post #19
kalleboo wrote: post #13

Earlier quoted context omitted.

Why wouldn't the application know?

The application knows unless it some app written by someone who is starting with programming.

If the application already knows then the person using it is already authenticated.

Re: “Username or password is incorrect” is bullshit

#28

Post by bonzini »

IshKebab wrote: post #25
yoodenvranx wrote: post #16

Earlier quoted context omitted.

Assume a site has two accounts "user122" and "user123". When a user logs in with "user122" and a password and it does not work: What happened? Did the user mistype the password or the username?

Assume a user got their username or password wrong. What is more likely, they got their username wrong in a way that happens to be the same as another user, or they got their password wrong?

Most people store passwords in their browser, which already makes the answer not that obvious.

For a rarely used web site, I honestly would have no idea if I registered as bonzini, pbonzini or bonzinip. Now my surname isn't particularly common, but smithj and jsmith might be easily confused.

Re: “Username or password is incorrect” is bullshit

#29

Post by IshKebab »

1ba9115454 wrote: post #22
aninhumer wrote: post #20

Earlier quoted context omitted.

Read the article. It's debunking that exact argument.

You read the article. Author backtracks at the end.

I read it. He doesn't. Read it again.

> To prevent attackers from knowing whether an account exists or not your signup must only take an email address and provide no feedback in the UI if the sign up succeeded or not. Instead the user would receive an email saying they’re signed up. The only way an attacker would know if an account exists is if they had access to the target’s email.

> Barring that, “username or password incorrect” is just bullshit.

What he means is the only way it would make sense is if and only if a website's account registration page responding with something like:

"You tried to sign up for me@example.com. If that account didn't already exist, a registration email has been sent to it."

But nobody does that! Registration pages just say "Sorry that email is already in use", which is what makes this whole thing bullshit.

Re: “Username or password is incorrect” is bullshit

#30

Post by endless1234 »

bolololo1 wrote: post #19
kalleboo wrote: post #13

Earlier quoted context omitted.

Why wouldn't the application know?

The application knows unless it some app written by someone who is starting with programming.

If the username exists, how does the app know whether the user typed the wrong username or password?
Post reply on HN