Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

“Invalid Username or Password”: a useless security measure (2014)

kevin.burke.dev

Post reply on HN
Print view View original

91–100 of 289 posts

Re: “Invalid Username or Password”: a useless security measure (2014)

#91

Post by Supermancho »

david422 wrote: post #30
comprev wrote: post #22

Earlier quoted context omitted.

Quoted post unavailable.

The article literally tells how the username can already be validated.

> The article literally tells how the username can already be validated.

The article says how many websites can allow that. This has nothing to do with the theory. This identifies poor implementations. These implementations trade reducing friction in signups, for some user security.

There's nothing wrong with "Invalid Username or Password" (eg ssh, et al), unless the security mechanism is self-sabotaged.

Re: “Invalid Username or Password”: a useless security measure (2014)

#92

Post by lhnz »

darrinmn wrote: post #80

> 99.9% of websites on the Internet will only let you create one account for each email address. So if you want to see if an email address has an account, try signing up for a new account with the same email address. This is not true if the signup flow is implemented correctly. Signing up for an account should always respond with the same message "we sent an email for you to confirm your account signup". The owner of…

If you did implement it like this it would be helpful to receive an email telling you that somebody has tried to re-register the email address you already have an account with.

Re: “Invalid Username or Password”: a useless security measure (2014)

#93

Post by yalogin »

A tangentially related question. I have, embarrassingly, not kept up with fido. What does it provide? I am guessing it provides a spec for a iOS keychain equivalent where passwords are stored in a dongle (or software) and “let out” based on user approval. I remember reading it also provides a new password-less auth mechanism. Is it out yet? If so is it adopted?

Re: “Invalid Username or Password”: a useless security measure (2014)

#94

Post by prmph »

dheera wrote: post #72
prmph wrote: post #29

Earlier quoted context omitted.

> If you mistype your username, you might have entered another, existing username. That's a good point, but there is no way the website can detect that situation, and I suspect it is much less likely than typing your correct username and the wrong password. > The website doesn't always know which one you got wrong, and assuming one way or the other just makes things worse. If the website doesn't know which one you go…

> there is no way the website can detect that situation Why? The website can salt, hash, match your password against all the hashed passwords for all the closest usernames within a certain edit distance. Not saying this is a good idea security-wise, but it's not impossible.

Apart from the security issues you've yourself noted, it's possible that the entered password matches another account's password coincidentally, not because the user intended to log in to that account.

Re: “Invalid Username or Password”: a useless security measure (2014)

#95

Post by Al-Khwarizmi »

darrinmn wrote: post #80

> 99.9% of websites on the Internet will only let you create one account for each email address. So if you want to see if an email address has an account, try signing up for a new account with the same email address. This is not true if the signup flow is implemented correctly. Signing up for an account should always respond with the same message "we sent an email for you to confirm your account signup". The owner of…

In simple registrations this is fine. In multi-page registrations with long forms, it can waste the user's time by making them input all the data again when it wasn't needed, though.

Except in really critical applications like payments, etc., as a user I'd rather have the convenience of being warned early about already having an account that the little extra security.

Re: “Invalid Username or Password”: a useless security measure (2014)

#96

Post by Marsymars »

baxtr wrote: post #34

> Here is an actual UX/security tradeoff: you can make the signup process email based. Great. Now I can’t share passwords any more with significant others. Instead I have to send them login credentials every time they want to login.

My approach is to have a shared email account for these situations.

Re: “Invalid Username or Password”: a useless security measure (2014)

#97

Post by metacritic12 »

darrinmn wrote: post #80

> 99.9% of websites on the Internet will only let you create one account for each email address. So if you want to see if an email address has an account, try signing up for a new account with the same email address. This is not true if the signup flow is implemented correctly. Signing up for an account should always respond with the same message "we sent an email for you to confirm your account signup". The owner of…

While clever, this system has UI tradeoffs, if I need to break my signup flow in order to click on a link and return to the signup page.

I believe this is also non-standard right now.

Re: “Invalid Username or Password”: a useless security measure (2014)

#98

Post by gohohn »

darrinmn wrote: post #80

> 99.9% of websites on the Internet will only let you create one account for each email address. So if you want to see if an email address has an account, try signing up for a new account with the same email address. This is not true if the signup flow is implemented correctly. Signing up for an account should always respond with the same message "we sent an email for you to confirm your account signup". The owner of…

Another method is to delegate the registration and login flow to external providers, using OAuth.

If you have to log in to a website via one of Microsoft, Google, Facebook, Twitter, etc. then, if implemented properly, there's no way of knowing if an account associated with this external identity exists already.

Re: “Invalid Username or Password”: a useless security measure (2014)

#99

Post by thomastjeffery »

Al-Khwarizmi wrote: post #95
darrinmn wrote: post #80

> 99.9% of websites on the Internet will only let you create one account for each email address. So if you want to see if an email address has an account, try signing up for a new account with the same email address. This is not true if the signup flow is implemented correctly. Signing up for an account should always respond with the same message "we sent an email for you to confirm your account signup". The owner of…

In simple registrations this is fine. In multi-page registrations with long forms, it can waste the user's time by making them input all the data again when it wasn't needed, though. Except in really critical applications like payments, etc., as a user I'd rather have the convenience of being warned early about already having an account that the little extra security.

You shouldn't be doing long web forms before creating an account anyway.

Re: “Invalid Username or Password”: a useless security measure (2014)

#100

Post by thomastjeffery »

lhnz wrote: post #92
darrinmn wrote: post #80

> 99.9% of websites on the Internet will only let you create one account for each email address. So if you want to see if an email address has an account, try signing up for a new account with the same email address. This is not true if the signup flow is implemented correctly. Signing up for an account should always respond with the same message "we sent an email for you to confirm your account signup". The owner of…

If you did implement it like this it would be helpful to receive an email telling you that somebody has tried to re-register the email address you already have an account with.

That's the option #2 they described.
Post reply on HN