So, as per the author, sites should first check if the user exists and then check the password? Why? What if the username belongs to someone else?
“Username or password is incorrect” is bullshit
31–40 of 170 posts
Re: “Username or password is incorrect” is bullshit
#32Signup and login should behave the same, and provide no information wether the email is registered or not. And username should be treated as public.
So for login: always say "email or password is incorrect".
And for register: as he said, always say "we sent you an email to verify your email".
Re: “Username or password is incorrect” is bullshit
#33The solution is relatively simple. 1. Email and password for login. Don't tell the attacker which is correct. 2. Email and password for registration. On registration send confirmation email. If user is already register attacker would need access to their email. Access to email is game over. So now an attacker can't see which users are registered with your service and you've protected your customers privacy. Extra poi…
Sure but everyone does 1, and not 2, so it's bullshit. Also what is a bigger annoyance? People can slowly use emails to look up if you have an account on a website, or it being a pain in the arse to log in?
Except on some sites, e.g. dating websites, this is a stupid theoretical security gain that just pisses everyone off. Like requiring numbers in passwords (basically everyone adds a 1 at the end) or making you change passwords frequently.
Re: “Username or password is incorrect” is bullshit
#34I like the dramatic style this opinion is written.
I could totally feel this blog post, not just read it.
Re: “Username or password is incorrect” is bullshit
#35Signup and login should behave the same, and provide no information wether the email is registered or not. And username should be treated as public. So for login: always say "email or password is incorrect". And for register: as he said, always say "we sent you an email to verify your email".
Except that when you are signing up, unless the service is using some draconian password formatting rules, any "email or password is incorrect" error can be inferred as the email is incorrect, and if the email format is correct, it's must likely because the email was taken.
"email or password is incorrect" is bullshit is right.
Re: “Username or password is incorrect” is bullshit
#36Earlier quoted context omitted.
The application doesn't know if the username you entered is actually yours or someone else's. You could provide the correct password to your account 'test', but not 'ttest'. The server just tells you to check both instead, it's more semantically correct and offers some security improvements with user enumeration.
It knows if it doesn't exist though. This whole thing is about sites that say "Username or password is wrong" when they know the username is wrong because it doesn't exist!
Is it? I thought it was about sites that say "Username or password is wrong" when they know the username does exist! After all, the author is using his own, correct, username in the examples!
Re: “Username or password is incorrect” is bullshit
#37Earlier quoted context omitted.
Why? Why not just tell the user what is actually wrong?
Because the application doesn't know what is actually wrong. The error message is actually correct as written. The user entered their username incorrectly or their password incorrectly, or both. The application doesn’t know which and shouldn’t guess!
This is true for existing user with wrong password, but that message would be wrong if the user doesn't exist. In this case, the error clearly would be the username, not the combination user+pass.
Re: “Username or password is incorrect” is bullshit
#38Earlier quoted context omitted.
You read the article. Author backtracks at the end.
I read it. He doesn't. Read it again. > To prevent attackers from knowing whether an account exists or not your signup must only take an email address and provide no feedback in the UI if the sign up succeeded or not. Instead the user would receive an email saying they’re signed up. The only way an attacker would know if an account exists is if they had access to the target’s email. > Barring that, “username or passw…
Exactly. You got it.
Re: “Username or password is incorrect” is bullshit
#39Re: “Username or password is incorrect” is bullshit
#40I have an argument for "username or password is incorrect" messages: it's possible that the password is correct, username exists but isn't the intended one. Then "password is incorrect" message would be lying, as the issue is actually with a username.