“Invalid Username or Password”: a useless security measure (2014) • Hacker News Board

Re: “Invalid Username or Password”: a useless security measure (2014)

#11

Post by bombcar » Wed, Nov 23, 2022, 2:04 PM UTC

martius wrote: post #6

There is also the question of leaking whether a given user has an account on a website or not. Maybe I don't want my employer to know that I have an account on competitor-service.com, or my partner to know that I have an account on kinky-thing.website. It might not be a security issue, but it could be a privacy issue.

This is a huge problem - if I know your email, and can get the error pages, I can find out where you have accounts; sometimes I can even find out the account name with that.

Even worse with phone numbers.

If you want to confirm a user is the same as another user on a different site, and you know their phone number, often part of the recovery process will reveal part of the phone (a text has been sent to *-*-*33, eg).

Re: “Invalid Username or Password”: a useless security measure (2014)

#12

Post by bombcar » Wed, Nov 23, 2022, 2:05 PM UTC

sabellito wrote: post #8

martius wrote: post #6

There is also the question of leaking whether a given user has an account on a website or not. Maybe I don't want my employer to know that I have an account on competitor-service.com, or my partner to know that I have an account on kinky-thing.website. It might not be a security issue, but it could be a privacy issue.

The author explains in the article that you're not protected from that case either, as the attacker can try to sign up with your email and find out anyway if that email is already registered.

He gives a solution for that and says it is "too cumbersome".

Re: “Invalid Username or Password”: a useless security measure (2014)

#13

Post by sgjohnson » Wed, Nov 23, 2022, 2:06 PM UTC

I'd say it's wrong to assume it's even a security measure. I'm fairly sure it goes like this

if (db->query("SELECT * FROM `users` WHERE `email` = 'yesthisisdog@gmail.com' AND `password` = MD5('hunter2')") {

    login(username);

} else {

    error('invalid username or password');

}

with nobody giving it a second thought.

Re: “Invalid Username or Password”: a useless security measure (2014)

#14

Post by bombcar » Wed, Nov 23, 2022, 2:06 PM UTC

sgjohnson wrote: post #7

martius wrote: post #6

There is also the question of leaking whether a given user has an account on a website or not. Maybe I don't want my employer to know that I have an account on competitor-service.com, or my partner to know that I have an account on kinky-thing.website. It might not be a security issue, but it could be a privacy issue.

> Maybe I don't want my employer to know that I have an account on competitor-service.com, or my partner to know that I have an account on kinky-thing.website. In that case, maybe employ the basic opsec measure of having a separate email account for competitor-service.com and kinky-thing.website?

For the vast majority of people, this is a bridge too far.

It is an advantage of using things like the apple-generated randomized emails for accounts.

Re: “Invalid Username or Password”: a useless security measure (2014)

#15

Post by dschooh » Wed, Nov 23, 2022, 2:07 PM UTC

sabellito wrote: post #8

martius wrote: post #6

There is also the question of leaking whether a given user has an account on a website or not. Maybe I don't want my employer to know that I have an account on competitor-service.com, or my partner to know that I have an account on kinky-thing.website. It might not be a security issue, but it could be a privacy issue.

The author explains in the article that you're not protected from that case either, as the attacker can try to sign up with your email and find out anyway if that email is already registered.

Not necessarily. You can design the sign up process by way of always ending with a message that says you will be notified.

Re: “Invalid Username or Password”: a useless security measure (2014)

#16

Post by truculent » Wed, Nov 23, 2022, 2:07 PM UTC

martius wrote: post #6

There is also the question of leaking whether a given user has an account on a website or not. Maybe I don't want my employer to know that I have an account on competitor-service.com, or my partner to know that I have an account on kinky-thing.website. It might not be a security issue, but it could be a privacy issue.

> Unfortunately this assumes that there's no other way for an attacker to discover whether a username/email address is registered for a service. This assumption is incorrect.

> 99.9% of websites on the Internet will only let you create one account for each email address. So if you want to see if an email address has an account, try signing up for a new account with the same email address.

This point is undermined by the sign-up workflow informing of whether an account is registered under a given username.

Re: “Invalid Username or Password”: a useless security measure (2014)

#17

Post by martius » Wed, Nov 23, 2022, 2:07 PM UTC

sgjohnson wrote: post #7

martius wrote: post #6

There is also the question of leaking whether a given user has an account on a website or not. Maybe I don't want my employer to know that I have an account on competitor-service.com, or my partner to know that I have an account on kinky-thing.website. It might not be a security issue, but it could be a privacy issue.

> Maybe I don't want my employer to know that I have an account on competitor-service.com, or my partner to know that I have an account on kinky-thing.website. In that case, maybe employ the basic opsec measure of having a separate email account for competitor-service.com and kinky-thing.website?

Sure, but if we are talking about improving user experience, I don't see how this helps.

Re: “Invalid Username or Password”: a useless security measure (2014)

#18

Post by Xylakant » Wed, Nov 23, 2022, 2:08 PM UTC

sabellito wrote: post #8

martius wrote: post #6

There is also the question of leaking whether a given user has an account on a website or not. Maybe I don't want my employer to know that I have an account on competitor-service.com, or my partner to know that I have an account on kinky-thing.website. It might not be a security issue, but it could be a privacy issue.

The author explains in the article that you're not protected from that case either, as the attacker can try to sign up with your email and find out anyway if that email is already registered.

Many services let you sign up with an existing email and just send a “you tried to sign up, but you seem to have an address already.” to the account owner. In that case it’s indistinguishable for the attacker.

Many services already require email confirmation to finalize the signup process so the extra effort is low.

Re: “Invalid Username or Password”: a useless security measure (2014)

#19

Post by justsomehnguy » Wed, Nov 23, 2022, 2:09 PM UTC

> Check submitted passwords against a dictionary of common passwords (123456, monkey, etc) and ban that traffic extra hard.

> Give guidance to users about creating strong passwords

Yeah, if I just want to talk about a propane with some folks I would eagerly wait to be lectured about IT security, scolded at my passwords of choice, go out of my way to appease site administrator's password policy...

Re: “Invalid Username or Password”: a useless security measure (2014)

#20

Post by sgjohnson » Wed, Nov 23, 2022, 2:11 PM UTC

martius wrote: post #17

sgjohnson wrote: post #7

Earlier quoted context omitted.

> Maybe I don't want my employer to know that I have an account on competitor-service.com, or my partner to know that I have an account on kinky-thing.website. In that case, maybe employ the basic opsec measure of having a separate email account for competitor-service.com and kinky-thing.website?

Sure, but if we are talking about improving user experience, I don't see how this helps.

OPSEC and user experience are completely unrelated things.

If you have something to hide (from anyone at all), you have to employ opsec measures. Using an email account that can't be immediately linked back to you is the most basic of them (and would be perfectly sufficient in the scenario described).

It wouldn't even matter if the website didn't leak in any way that an email is registered with them, because data breaches happen, and should one happen, you'd be fucked from that perspective anyway. Remember the Ashley Madison leak?