“Invalid Username or Password”: a useless security measure (2014)
1–10 of 289 posts
Re: “Invalid Username or Password”: a useless security measure (2014)
#2I've worked in infosec for over 15 years. I've built security programs from the ground up at two companies.
I've learned much of compliance/security is cargo culting and/or streetlight effect, if not radicalized.
You can debate the standards, just like you can debate with your retired uncle who watches way too much fox news.
The better solution is to find good enough solutions that let infosec teams check their boxes and move on to more important work.
Re: “Invalid Username or Password”: a useless security measure (2014)
#3Does it matter given that browsers can remember the username/password anyhow?
On the other hand it's probably more important for user experience to encourage secure (long) memorable passwords rather than the fashion of impossible-to-remember short random ones. i.e I understand that something like "Iamafunnysailorwithalittlereddog" is better than "4kbjk5rv!" simply because length makes any password much harder to crack than the variety of each character.
Re: “Invalid Username or Password”: a useless security measure (2014)
#4Oh boy. This is actually a good point.
I guess having the nondescript error message has always been "best practices" or maybe it has crossed the road and has become cargo cult now.
Re: “Invalid Username or Password”: a useless security measure (2014)
#5But the error message can be true. If you mistype your username, you might have entered another, existing username. Just telling the user 'wrong password' will mean they are less likely to check that the username was correct.
The website doesn't always know which one you got wrong, and assuming one way or the other just makes things worse.
Re: “Invalid Username or Password”: a useless security measure (2014)
#6There is also the question of leaking whether a given user has an account on a website or not.
Maybe I don't want my employer to know that I have an account on competitor-service.com, or my partner to know that I have an account on kinky-thing.website.
It might not be a security issue, but it could be a privacy issue.
Re: “Invalid Username or Password”: a useless security measure (2014)
#7There is also the question of leaking whether a given user has an account on a website or not. Maybe I don't want my employer to know that I have an account on competitor-service.com, or my partner to know that I have an account on kinky-thing.website. It might not be a security issue, but it could be a privacy issue.
> Maybe I don't want my employer to know that I have an account on competitor-service.com, or my partner to know that I have an account on kinky-thing.website.
In that case, maybe employ the basic opsec measure of having a separate email account for competitor-service.com and kinky-thing.website?
Re: “Invalid Username or Password”: a useless security measure (2014)
#8There is also the question of leaking whether a given user has an account on a website or not. Maybe I don't want my employer to know that I have an account on competitor-service.com, or my partner to know that I have an account on kinky-thing.website. It might not be a security issue, but it could be a privacy issue.
The author explains in the article that you're not protected from that case either, as the attacker can try to sign up with your email and find out anyway if that email is already registered.
Re: “Invalid Username or Password”: a useless security measure (2014)
#9This is assuming that the service allows new users to sign up themselves.
Also, testing it via signup sends a lot of emails to the victim (if the attacker tries a number of services), so the victim at least knows that something is up.
Re: “Invalid Username or Password”: a useless security measure (2014)
#10Another reason to use unique email addresses for each service is that it’s almost impossible for someone to discover if you’ve already signed up