Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

“Username or password is incorrect” is bullshit

hackernoon.com

Post reply on HN
Print view View original

61–70 of 170 posts

Re: “Username or password is incorrect” is bullshit

#61

Post by icebraining »

rodorgas wrote: post #37
tome wrote: post #11

Earlier quoted context omitted.

Because the application doesn't know what is actually wrong. The error message is actually correct as written. The user entered their username incorrectly or their password incorrectly, or both. The application doesn’t know which and shouldn’t guess!

This is true for existing user with wrong password, but that message would be wrong if the user doesn't exist. In this case, the error clearly would be the username, not the combination user+pass.

How can the pass be correct if the username isn't? A password is only correct in the context of a specific account.

Re: “Username or password is incorrect” is bullshit

#62

Post by rimliu »

bo1024 wrote: post #57
cdancette wrote: post #32

Signup and login should behave the same, and provide no information wether the email is registered or not. And username should be treated as public. So for login: always say "email or password is incorrect". And for register: as he said, always say "we sent you an email to verify your email".

Why? I don't see why it's important to hide existence of a user unless you're allowing people to try multiple logins per second on your site. (I'm not an expert so I am sincerely asking to help me understand.)

You are leaking the information. Maybe you want to check if your buddy is a registered on some controversial site, or maybe you want to target someone for hacking…

Re: “Username or password is incorrect” is bullshit

#63

Post by u801e »

Not quite on topic, but it would be nice if more websites would offer the option of using client side TLS certificate "login" with or without an additional prompt for a username and password.

It would be next to impossible for an attacker to bypass that. For example, even if the attacker provided the correct credentials, they most likely would not have the associated client-side TLS certificate private key. Then the server could just reject the log on attempt outright (since the certificate wasn't provided or verified).

Re: “Username or password is incorrect” is bullshit

#64

Post by icebraining »

tzs wrote: post #52
1ba9115454 wrote: post #17

The solution is relatively simple. 1. Email and password for login. Don't tell the attacker which is correct. 2. Email and password for registration. On registration send confirmation email. If user is already register attacker would need access to their email. Access to email is game over. So now an attacker can't see which users are registered with your service and you've protected your customers privacy. Extra poi…

> 2. Email and password for registration. On registration send confirmation email. This opens up a different problem. It should be: 2. Email only for tentative registration. On tentative registration, send confirmation email. 3. User clicks link in confirmation email, which takes to page for setting password. (Alternatively, confirmation email includes randomly generated initial password, user is required to change i…

You should definitively set the password after clicking the link. That said, what would an attacker do with that account?

Re: “Username or password is incorrect” is bullshit

#65

Post by larzang »

IshKebab wrote: post #25
yoodenvranx wrote: post #16

Earlier quoted context omitted.

Assume a site has two accounts "user122" and "user123". When a user logs in with "user122" and a password and it does not work: What happened? Did the user mistype the password or the username?

Assume a user got their username or password wrong. What is more likely, they got their username wrong in a way that happens to be the same as another user, or they got their password wrong?

I have a commonish firstlast@gmail account and frequently receive what is the obvious result of people in various parts of the country incorrectly providing my email to apply for jobs, order pizzas, and use other services.

It is absolutely common for users to supply the incorrect username/email.

Re: “Username or password is incorrect” is bullshit

#67

Post by gregoriol »

ajuc wrote: post #56
GlitchMr wrote: post #40

I have an argument for "username or password is incorrect" messages: it's possible that the password is correct, username exists but isn't the intended one. Then "password is incorrect" message would be lying, as the issue is actually with a username.

You mean you log onto John with password 12345 and the website says "Some other user uses this password, but not John"? Seems wrong, somehow.

If you, as a developer, are technically able to check that the password is used by another user, you have failed pretty big at best practices.

Re: “Username or password is incorrect” is bullshit

#68

Post by brepl »

GlitchMr wrote: post #40

I have an argument for "username or password is incorrect" messages: it's possible that the password is correct, username exists but isn't the intended one. Then "password is incorrect" message would be lying, as the issue is actually with a username.

If the username is used as the salt when storing the hashed password in the database, it's unpossible to know if a supplied password is valid-but-for-a-different-account.

Re: “Username or password is incorrect” is bullshit

#69

Post by Terr_ »

bo1024 wrote: post #57
cdancette wrote: post #32

Signup and login should behave the same, and provide no information wether the email is registered or not. And username should be treated as public. So for login: always say "email or password is incorrect". And for register: as he said, always say "we sent you an email to verify your email".

Why? I don't see why it's important to hide existence of a user unless you're allowing people to try multiple logins per second on your site. (I'm not an expert so I am sincerely asking to help me understand.)

We're used to assuming that the attacker knows a login and is guessing at a password, however the opposite scenario is is increasingly common.

Suppose another website has a security breach, revealing many names and passwords. User John Doe used a password of "foo", so an attacker starts trying combinations like jdoe/foo or johnd/foo or john_doe/foo, looking for the same person reusing a password on your site.

By denying them information about which login names exist, it's harder for the attacker to either zero-in on the correct username (and try alternate password variations) or to be certain that they've got nothing and that it's time to move on.

Post reply on HN