This might need (2014) in the title
“Invalid Username or Password”: a useless security measure (2014)
21–30 of 289 posts
Re: “Invalid Username or Password”: a useless security measure (2014)
#22But the error message can be true. If you mistype your username, you might have entered another, existing username. Just telling the user 'wrong password' will mean they are less likely to check that the username was correct. The website doesn't always know which one you got wrong, and assuming one way or the other just makes things worse.
No post body was provided.
Re: “Invalid Username or Password”: a useless security measure (2014)
#23I'd say it's wrong to assume it's even a security measure. I'm fairly sure it goes like this if (db->query("SELECT * FROM `users` WHERE `email` = 'yesthisisdog@gmail.com' AND `password` = MD5('hunter2')") { login(username); } else { error('invalid username or password'); } with nobody giving it a second thought.
Which in itself would be a bad security practice because that would mean that the passwords aren't individually salted.
Re: “Invalid Username or Password”: a useless security measure (2014)
#24I'd say it's wrong to assume it's even a security measure. I'm fairly sure it goes like this if (db->query("SELECT * FROM `users` WHERE `email` = 'yesthisisdog@gmail.com' AND `password` = MD5('hunter2')") { login(username); } else { error('invalid username or password'); } with nobody giving it a second thought.
Which in itself would be a bad security practice because that would mean that the passwords aren't individually salted.
And they would be hashed using MD5!
But on a serious note, it's possible to individually salt passwords, and still match username & password in one query.
Re: “Invalid Username or Password”: a useless security measure (2014)
#25True but aren't username/password passe? Username should be 'account details' like mother's maiden name or zipcode, not a security feature.
And short passwords you change a lot - what a weak system!
How about provide a cryptographic key and that's it. It's right or it's wrong.
Or heck, if it's not recognized then just create a new empty account.
Re: “Invalid Username or Password”: a useless security measure (2014)
#26But the error message can be true. If you mistype your username, you might have entered another, existing username. Just telling the user 'wrong password' will mean they are less likely to check that the username was correct. The website doesn't always know which one you got wrong, and assuming one way or the other just makes things worse.
Quoted post unavailable.
Again, how is that leakage, if you can just try registering a new account and see if that username or email already exists?
Re: “Invalid Username or Password”: a useless security measure (2014)
#27But the error message can be true. If you mistype your username, you might have entered another, existing username. Just telling the user 'wrong password' will mean they are less likely to check that the username was correct. The website doesn't always know which one you got wrong, and assuming one way or the other just makes things worse.
Quoted post unavailable.
True, but the story covers that aspect - many systems provide other ways to check if a username exists (e.g. trying to register a new account, or sending an email to a gmail address, and so on)
Re: “Invalid Username or Password”: a useless security measure (2014)
#28But the error message can be true. If you mistype your username, you might have entered another, existing username. Just telling the user 'wrong password' will mean they are less likely to check that the username was correct. The website doesn't always know which one you got wrong, and assuming one way or the other just makes things worse.
Quoted post unavailable.
No post body was provided.
Re: “Invalid Username or Password”: a useless security measure (2014)
#29But the error message can be true. If you mistype your username, you might have entered another, existing username. Just telling the user 'wrong password' will mean they are less likely to check that the username was correct. The website doesn't always know which one you got wrong, and assuming one way or the other just makes things worse.
> If you mistype your username, you might have entered another, existing username.
That's a good point, but there is no way the website can detect that situation, and I suspect it is much less likely than typing your correct username and the wrong password.
> The website doesn't always know which one you got wrong, and assuming one way or the other just makes things worse.
If the website doesn't know which one you got wrong, then yes, it should just tell you so; the article is not arguing otherwise.
Re: “Invalid Username or Password”: a useless security measure (2014)
#30But the error message can be true. If you mistype your username, you might have entered another, existing username. Just telling the user 'wrong password' will mean they are less likely to check that the username was correct. The website doesn't always know which one you got wrong, and assuming one way or the other just makes things worse.
Quoted post unavailable.
The article literally tells how the username can already be validated.