Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

“Invalid Username or Password”: a useless security measure (2014)

kevin.burke.dev

Post reply on HN
Print view View original

71–80 of 289 posts

Re: “Invalid Username or Password”: a useless security measure (2014)

#71

Post by tluyben2 »

capableweb wrote: post #35
comprev wrote: post #22

Earlier quoted context omitted.

Quoted post unavailable.

This is mentioned in the submission. The argument is as follows: If you're vague on the login page but still do the validation on the signup page, the information leakage happens regardless, just on the signup page rather than login, as most websites only allow one account per email.

I just finish the registration process as normal but email the email that someone is trying to sign up again and if it is them.

The user who signs up won’t notice anything.

Re: “Invalid Username or Password”: a useless security measure (2014)

#72

Post by dheera »

prmph wrote: post #29
joosters wrote: post #5

But the error message can be true. If you mistype your username, you might have entered another, existing username. Just telling the user 'wrong password' will mean they are less likely to check that the username was correct. The website doesn't always know which one you got wrong, and assuming one way or the other just makes things worse.

> If you mistype your username, you might have entered another, existing username. That's a good point, but there is no way the website can detect that situation, and I suspect it is much less likely than typing your correct username and the wrong password. > The website doesn't always know which one you got wrong, and assuming one way or the other just makes things worse. If the website doesn't know which one you go…

> there is no way the website can detect that situation

Why? The website can salt, hash, match your password against all the hashed passwords for all the closest usernames within a certain edit distance.

Not saying this is a good idea security-wise, but it's not impossible.

Re: “Invalid Username or Password”: a useless security measure (2014)

#74

Post by baxtr »

progval wrote: post #64
baxtr wrote: post #34

> Here is an actual UX/security tradeoff: you can make the signup process email based. Great. Now I can’t share passwords any more with significant others. Instead I have to send them login credentials every time they want to login.

The author only recommends doing this on signup, ie. registration. Not on login.

Thanks. You’re right. Didn’t read carefully enough.

Re: “Invalid Username or Password”: a useless security measure (2014)

#75

Post by pmontra »

Xylakant wrote: post #18
sabellito wrote: post #8

Earlier quoted context omitted.

The author explains in the article that you're not protected from that case either, as the attacker can try to sign up with your email and find out anyway if that email is already registered.

Many services let you sign up with an existing email and just send a “you tried to sign up, but you seem to have an address already.” to the account owner. In that case it’s indistinguishable for the attacker. Many services already require email confirmation to finalize the signup process so the extra effort is low.

Those sites probably prompt the attacker with a "We have sent you an email with an activation link" and the owner receives the "you tried to sign up, but you seem to have an address already" message. In this way they don't leak anything to the attacker.

By the way, I've been stuck for years with an ecommerce site that thinks I already registered with them using my email. They're telling me that I must activate the account. I click the link to send me the activation message again but then they say that my email is not registered with them. I'm still stuck and will probably never buy from them because I can't.

Re: “Invalid Username or Password”: a useless security measure (2014)

#76

Post by duxup »

kuschku wrote: post #26
comprev wrote: post #22

Earlier quoted context omitted.

Quoted post unavailable.

Again, how is that leakage, if you can just try registering a new account and see if that username or email already exists?

Do most people who are throwing usernames and passwords at websites ... do that?

Re: “Invalid Username or Password”: a useless security measure (2014)

#77

Post by nerf3000 »

I don't think saying "but these popular sites let you enumerate registered email addresses via this other form" is justification to be lax about protecting against user enumeration attacks on your own site.

The actual take away should be more like "I found a security issue in the registration form of these popular sites, they should fix it"

Enumerating valid emails, even if rate limited, lets an attacker build a contact book for targeted phishing attacks, connecting leaked passwords, brute forcing and is also useful in recon to determine what sites a person may have an account with, and more. It's worth protecting against as much as possible.

Re: “Invalid Username or Password”: a useless security measure (2014)

#78

Post by amelius »

comprev wrote: post #22
joosters wrote: post #5

But the error message can be true. If you mistype your username, you might have entered another, existing username. Just telling the user 'wrong password' will mean they are less likely to check that the username was correct. The website doesn't always know which one you got wrong, and assuming one way or the other just makes things worse.

Quoted post unavailable.

If you just say "invalid username+password combination", then you can have both security and a correct message.

Re: “Invalid Username or Password”: a useless security measure (2014)

#79

Post by yegle »

baxtr wrote: post #34

> Here is an actual UX/security tradeoff: you can make the signup process email based. Great. Now I can’t share passwords any more with significant others. Instead I have to send them login credentials every time they want to login.

Exactly! McDonald's (US app) is using a login system like this. Worse, they automatically log out all other logins once someone logs in on one device. Eventually I became the designated pickup person of my house.

Re: “Invalid Username or Password”: a useless security measure (2014)

#80

Post by darrinmn »

> 99.9% of websites on the Internet will only let you create one account for each email address. So if you want to see if an email address has an account, try signing up for a new account with the same email address.

This is not true if the signup flow is implemented correctly. Signing up for an account should always respond with the same message "we sent an email for you to confirm your account signup". The owner of that email address then receives an email - either 1) normal signup process, or 2) "did you just try to sign up? You already have a valid account for this email address."

This way you cannot tell via the signup web form alone whether an account exists or not. You need to have access to the email address.

Post reply on HN