Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

“Username or password is incorrect” is bullshit

hackernoon.com

Post reply on HN
Print view View original

71–80 of 170 posts

Re: “Username or password is incorrect” is bullshit

#71

Post by pornel »

The right answer isn't a blanket "sites should do this super-secret e-mail-only shuffle and not tell you anything".

First, you should define your threat model: which information is considered secret and which isn't, and treat any violations as security vulnerabilities.

If usernames are public by design, then don't hide them in one form, and expose in URLs elsewhere on the site.

If exposing who's registered on your site really is a threat, then by all means have a weird registration (and password reminder) that doesn't tell whether it worked or not. But if your site is for cookie receipies and you don't consider exposing who's a fan of cookies a privacy violation, then just use most helpful messages you can.

Re: “Username or password is incorrect” is bullshit

#72

Post by TranceMan »

bo1024 wrote: post #57
cdancette wrote: post #32

Signup and login should behave the same, and provide no information wether the email is registered or not. And username should be treated as public. So for login: always say "email or password is incorrect". And for register: as he said, always say "we sent you an email to verify your email".

Why? I don't see why it's important to hide existence of a user unless you're allowing people to try multiple logins per second on your site. (I'm not an expert so I am sincerely asking to help me understand.)

I could find user 'bo1024' has an account on pornhub - not necessarily you and you might not care but certain situations it may be a problem.

You could argue it's security through obscurity - I'd say preventing leaking data.

Re: “Username or password is incorrect” is bullshit

#73

Post by nhumrich »

j_s wrote: post #66

Ask HN: Why does Amazon allow multiple accounts with the same email address? (2014) | https://news.ycombinator.com/item?id=7075372

Interesting. Just reading this now, but it makes me wonder, what happens if you set two accounts to the same password?

Re: “Username or password is incorrect” is bullshit

#74

Post by rmetzler »

This is actually a feature for users who have almost the same username and mistype this instead the password. E.g. this could probably happen through an unfamilar kayboard layout.

I understand that a lot of people think this is a security feature, but once upon a time it was the lazy programmers answer when "SELECT * FROM users WHERE username=? AND password=?" didn't return a result.

With proper salts for hashed passwords you now have to find the username, use the salt to hash the password and compare this. If your database allows to hash passwords with a dedicated function it's still the easiest to say username OR password must be wrong.

Re: “Username or password is incorrect” is bullshit

#75

Post by irishsultan »

ajuc wrote: post #56
GlitchMr wrote: post #40

I have an argument for "username or password is incorrect" messages: it's possible that the password is correct, username exists but isn't the intended one. Then "password is incorrect" message would be lying, as the issue is actually with a username.

You mean you log onto John with password 12345 and the website says "Some other user uses this password, but not John"? Seems wrong, somehow.

More like, I log in as john with password 12345, but I forgot that I had to sign up as john87, so the password is correct and saying it isn't is misleading (even though the system doesn't know that for a fact, it is a possibility).

Re: “Username or password is incorrect” is bullshit

#76

Post by IanCal »

bo1024 wrote: post #57
cdancette wrote: post #32

Signup and login should behave the same, and provide no information wether the email is registered or not. And username should be treated as public. So for login: always say "email or password is incorrect". And for register: as he said, always say "we sent you an email to verify your email".

Why? I don't see why it's important to hide existence of a user unless you're allowing people to try multiple logins per second on your site. (I'm not an expert so I am sincerely asking to help me understand.)

Very quick examples, if I can check if an email address is registered on a site I can

1. Identify people who are gay/bi (e.g. signed up to grindr)

2. Identify political affiliations (depending on site)

3. Identify health issues (signed up to a mental health forum, or cancer support group, etc)

These things people might be happy others knowing, but I hope you can at least see some cases where you might not.

Re: “Username or password is incorrect” is bullshit

#77

Post by jdietrich »

bo1024 wrote: post #57
cdancette wrote: post #32

Signup and login should behave the same, and provide no information wether the email is registered or not. And username should be treated as public. So for login: always say "email or password is incorrect". And for register: as he said, always say "we sent you an email to verify your email".

Why? I don't see why it's important to hide existence of a user unless you're allowing people to try multiple logins per second on your site. (I'm not an expert so I am sincerely asking to help me understand.)

Disclosing the existence of a user increases the success rate of certain attacks.

Say I've got a leaked password database for foo.com and know that the user bob@gmail.com uses the password "tomato1". If I try using his credentials to log into bar.com and get the message "username or password is incorrect", I'm just going to try the next user on the list. If I get the message "incorrect password", it makes sense for me to try "tomato2", "tomato3" etc. If I know that your password policy requires eight characters and a capital letter, I'm going to try "Tomato11". This is obviously trivial to automate.

You can't protect your users against credential-stuffing attacks if they use the same password everywhere, but you can offer them a small layer of protection if they use the same password with minor variations.

As others have pointed out, mere disclosure of the existence of an account could be a serious privacy breach in itself.

Re: “Username or password is incorrect” is bullshit

#78

Post by nhumrich »

brepl wrote: post #68
GlitchMr wrote: post #40

I have an argument for "username or password is incorrect" messages: it's possible that the password is correct, username exists but isn't the intended one. Then "password is incorrect" message would be lying, as the issue is actually with a username.

If the username is used as the salt when storing the hashed password in the database, it's unpossible to know if a supplied password is valid-but-for-a-different-account.

Wow, using the user as the salt is awesome. Is this considered an ok security practice?

Re: “Username or password is incorrect” is bullshit

#79

Post by irishsultan »

icebraining wrote: post #61
rodorgas wrote: post #37

Earlier quoted context omitted.

This is true for existing user with wrong password, but that message would be wrong if the user doesn't exist. In this case, the error clearly would be the username, not the combination user+pass.

How can the pass be correct if the username isn't? A password is only correct in the context of a specific account.

The password may be correct for the user (who is a person, and has a password for that service).

Of course the person may have multiple user accounts and he may have given the "wrong" password for the "right" username account, but he may also have given the "right" password for the "wrong" username.

Re: “Username or password is incorrect” is bullshit

#80

Post by mdahlstrand »

u801e wrote: post #63

Not quite on topic, but it would be nice if more websites would offer the option of using client side TLS certificate "login" with or without an additional prompt for a username and password. It would be next to impossible for an attacker to bypass that. For example, even if the attacker provided the correct credentials, they most likely would not have the associated client-side TLS certificate private key. Then the…

Sounds like a great solution - would browsers need to support it? Do you have any resources on implementing it?
Post reply on HN