... also, you can often do "Forgot my password" and if you give unregistered email it will tell you that.
“Username or password is incorrect” is bullshit
101–110 of 170 posts
Re: “Username or password is incorrect” is bullshit
#102Signup and login should behave the same, and provide no information wether the email is registered or not. And username should be treated as public. So for login: always say "email or password is incorrect". And for register: as he said, always say "we sent you an email to verify your email".
If you have a user name, why do you care about e-mail? Let people enter an arbitrary user name, and log in with that. Username enumeration doesn't carry privacy concerns since users can ensure their usernames don't reveal personal information. For duplicate e-mails on signup, who cares? Since you're not using them as an identifier, let multiple users have the same e-mail address. Making your validation errors cross m…
I think you have a good point in that if you are going to use usernames as an identifier, there is an argument that having an email also be an identifier is sort of redundant.
One problem with that is that when users are given the option of an arbitrary username, they tend to be much more likely to forget that username than they are the email address they use daily. So, you need some way of resetting their password and letting the user recover their username. In some cases, you could pair that with other identifiers, like their name, phone, social security number, etc. However, then you are just trading the email as an identifier for something else, which you would also need to check during registration.
For this reason, I've found that moving away from a username and just relying on an email for a login makes managing multi-user sites a great deal easier from an admin side.
Re: “Username or password is incorrect” is bullshit
#103Try searching for your username on https://namechk.com/ https://www.namecheckr.com/ http://checkusernames.com/ or https://pipl.com. I am sure these name checkers can't be built if they have to spam the sign up forms just to check availability (at least not for free if they have to pay for manual recaptchas).
The privacy is worth it.
Re: “Username or password is incorrect” is bullshit
#104Earlier quoted context omitted.
More like, I log in as john with password 12345, but I forgot that I had to sign up as john87, so the password is correct and saying it isn't is misleading (even though the system doesn't know that for a fact, it is a possibility).
But how would the system know you're supposed to log in as john87? It would have to check your password against ALL passwords (which shouldn't be technically possible in the first place, because passwords should be hashed and salted, and the only way to check if they are valid should be in context of the given user - as gregoriol noticed).
It doesn't, so it doesn't know whether your password is incorrect, so if it claims it is incorrect it is saying something it doesn't know for sure.
Also it's technically possible to check the password against all other passwords, it just requires rehashing it for every user in the table, you shouldn't do it obviously.
edit: Even if you would check it, it wouldn't help to answer the question about whether the password or the username is wrong, even if the password is used for a different username you still don't know that it's the right password. So it's a bit strange that it is brought up as an issue that you can't check against other usernames.
Re: “Username or password is incorrect” is bullshit
#105In the article:
"You gain no security, yet your customers lose clarity."
Oh boohoo. Like it's not on the customers side to know which email it is and which password.
And as many have said, one does gain privacy.
Re: “Username or password is incorrect” is bullshit
#106Earlier quoted context omitted.
If you have a user name, why do you care about e-mail? Let people enter an arbitrary user name, and log in with that. Username enumeration doesn't carry privacy concerns since users can ensure their usernames don't reveal personal information. For duplicate e-mails on signup, who cares? Since you're not using them as an identifier, let multiple users have the same e-mail address. Making your validation errors cross m…
I think you have a good point in that if you are going to use usernames as an identifier, there is an argument that having an email also be an identifier is sort of redundant. One problem with that is that when users are given the option of an arbitrary username, they tend to be much more likely to forget that username than they are the email address they use daily. So, you need some way of resetting their password a…
That's fine though, sending a forgot username / password e-mail is much simpler to do without exposing the fact that you know their e-mail (just send a "sorry, we don't have that e-mail on file" to the e-mail address if there's no match)
I agree that e-mail makes for a better login experience, but if exposing who uses your site is too much of a privacy concern, I'd rather move to usernames than have to implement awkward user experiences to never reveal whether someone is a user or not.
Re: “Username or password is incorrect” is bullshit
#107Not quite on topic, but it would be nice if more websites would offer the option of using client side TLS certificate "login" with or without an additional prompt for a username and password. It would be next to impossible for an attacker to bypass that. For example, even if the attacker provided the correct credentials, they most likely would not have the associated client-side TLS certificate private key. Then the…
Sounds like a great solution - would browsers need to support it? Do you have any resources on implementing it?
This is how web auth was supposed to work. It turned out to be too hard to deploy outside of enterprises.
U2F is the modern re-do of client certs.
Re: “Username or password is incorrect” is bullshit
#108Earlier quoted context omitted.
I think you have a good point in that if you are going to use usernames as an identifier, there is an argument that having an email also be an identifier is sort of redundant. One problem with that is that when users are given the option of an arbitrary username, they tend to be much more likely to forget that username than they are the email address they use daily. So, you need some way of resetting their password a…
That's fine though, sending a forgot username / password e-mail is much simpler to do without exposing the fact that you know their e-mail (just send a "sorry, we don't have that e-mail on file" to the e-mail address if there's no match) I agree that e-mail makes for a better login experience, but if exposing who uses your site is too much of a privacy concern, I'd rather move to usernames than have to implement awkw…
I think a lot of sites already do that, although they may not send an email saying 'sorry, we don't have that e-mail on file,' it is pretty common to get a 'if that email exists, we have sent a reset e-mail to it' message when you do a password reset that doesn't expose if the email exists in the system.
Although to the point of this article, they will then happily tell you you can't use an email during signup, so it is a mixed-bag.
I suppose if you allowed multiple usernames per email, you could just email them all the usernames that they have on that email address when they forgot their username, but that seems like a clunky setup. It probably depends a lot on the service though, as someone posted a link to a discussion from 2014 about Amazon's reasoning for allowing multiple emails elsewhere in this thread, which makes a bit of sense for their use-case.
Re: “Username or password is incorrect” is bullshit
#109Here is a super useful article about how you should build login https://blog.codinghorror.com/the-god-login/ (if you don't want to rely on professionals from Auth0 or Okta :-). In the article, there is a very good statement "being user friendly is way more important than being secure" and this is exactly this case also...
Re: “Username or password is incorrect” is bullshit
#110Earlier quoted context omitted.
Not really. "Default to privacy" is what gives you insane useless UXes like the one in the article, where you're making login (already a frustrating experience) more painful with absolutely zero gain in security. Default to knowing your threat model. Default to balancing security concerns with UX, and make an informed decision instead of blindly following best practices.
I don’t want others to know all of the places where I have accounts. That’s an easy way to be targeted.
That's the point of the article though - for a large percentage of services, if you know the username/email address you are targeting, you can just try to register them and see if it works. Obfuscating the login process makes little difference.