Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

“Invalid Username or Password”: a useless security measure (2014)

kevin.burke.dev

Post reply on HN
Print view View original

141–150 of 289 posts

Re: “Invalid Username or Password”: a useless security measure (2014)

#141

Post by dexterdog »

hairofadog wrote: post #42

On this topic, I've noticed a lot of sites have split their sign-in forms into a two step process (submit username, then submit password). Does anyone know what this achieves? It seems like it would be trivial for an automated script to submit the form twice, but as a human I often have to open 1Password multiple times to navigate the process. For example: https://myaccount.nytimes.com/auth/login

2-step signins are so annoying for those of us who don't use it. I imagine they are also annoying for people who use it because they still have to first type in their email address instead of just going to the google/fb/apple/etc page where they click on their identity.

Re: “Invalid Username or Password”: a useless security measure (2014)

#142

Post by [deleted] »

zhfliz wrote: post #103
thomastjeffery wrote: post #99

Earlier quoted context omitted.

You shouldn't be doing long web forms before creating an account anyway.

You shouldn't be taking my email just to demand lots of information from me after I already gave my email to you. If you demand lots of information that should be clear right away.

[deleted]

Re: “Invalid Username or Password”: a useless security measure (2014)

#143

Post by asddubs »

wongarsu wrote: post #32
Xylakant wrote: post #18

Earlier quoted context omitted.

Many services let you sign up with an existing email and just send a “you tried to sign up, but you seem to have an address already.” to the account owner. In that case it’s indistinguishable for the attacker. Many services already require email confirmation to finalize the signup process so the extra effort is low.

And those services also plug the forgotten-password information leak by just informing you "if you have an account, you got an email" instead of giving you an explicit success or error message. I guess the better point for the article would be "many websites cargo-cult the login error message without understanding why it's there and how that should impact the rest of the service"

sounds like a nightmare for someone who forgot their password and has multiple emails, and isn't sure which one is right. did i use the wrong email, did it land in the spam folder, or did my email provider just quietly delete the email (which unfortunately does happen, and not just with dodgy emails/IPs)

Re: “Invalid Username or Password”: a useless security measure (2014)

#144

Post by cryptoegorophy »

layer8 wrote: post #104
darrinmn wrote: post #80

> 99.9% of websites on the Internet will only let you create one account for each email address. So if you want to see if an email address has an account, try signing up for a new account with the same email address. This is not true if the signup flow is implemented correctly. Signing up for an account should always respond with the same message "we sent an email for you to confirm your account signup". The owner of…

This is bad in the case of online orders, where the order will usually go through anyway (vendors want to sell even when you don’t confirm your email address, and don’t care a lot about someone else getting the notification emails), because if by mistake you registered your email address as new although you already had an account with that address, the order won’t get associated with your account. Or if it does autom…

Woocommerce plug-in of Wordpress solved that issue. You can checkout as a guest with someone else’s email, you won’t see other orders from that email and if you do want to see them then you need to sign up for an account

Re: “Invalid Username or Password”: a useless security measure (2014)

#145

Post by datalopers »

sgjohnson wrote: post #13

I'd say it's wrong to assume it's even a security measure. I'm fairly sure it goes like this if (db->query("SELECT * FROM `users` WHERE `email` = 'yesthisisdog@gmail.com' AND `password` = MD5('hunter2')") { login(username); } else { error('invalid username or password'); } with nobody giving it a second thought.

> MD5(‘****’)

That’s cool HN censors passwords like this

Re: “Invalid Username or Password”: a useless security measure (2014)

#146

Post by emodendroket »

darrinmn wrote: post #80

> 99.9% of websites on the Internet will only let you create one account for each email address. So if you want to see if an email address has an account, try signing up for a new account with the same email address. This is not true if the signup flow is implemented correctly. Signing up for an account should always respond with the same message "we sent an email for you to confirm your account signup". The owner of…

That exact strategy is described in the second paragraph but the author argues (and I agree) that it is so arduous it will cause you to lose many users for questionable benefit.

Re: “Invalid Username or Password”: a useless security measure (2014)

#147

Post by emodendroket »

thefreeman wrote: post #113
darrinmn wrote: post #80

> 99.9% of websites on the Internet will only let you create one account for each email address. So if you want to see if an email address has an account, try signing up for a new account with the same email address. This is not true if the signup flow is implemented correctly. Signing up for an account should always respond with the same message "we sent an email for you to confirm your account signup". The owner of…

And then what happens when the user tries to login with the password they just "created". They will get the same error message as before, but be extremely confused since they just "registered" with that password. Not to mention their browser may have prompted and stored the fake registration password, etc.

You’d defer password setting if you were doing this I would think.

Re: “Invalid Username or Password”: a useless security measure (2014)

#148

Post by darrinmn »

emodendroket wrote: post #146
darrinmn wrote: post #80

> 99.9% of websites on the Internet will only let you create one account for each email address. So if you want to see if an email address has an account, try signing up for a new account with the same email address. This is not true if the signup flow is implemented correctly. Signing up for an account should always respond with the same message "we sent an email for you to confirm your account signup". The owner of…

That exact strategy is described in the second paragraph but the author argues (and I agree) that it is so arduous it will cause you to lose many users for questionable benefit.

Yes but the exact quote is confusing as he specifically mentions email addresses (in bold text). I know the author mentions usernames elsewhere in the article and I agree with the author this isn't applicable to websites that allow username signup since anyone can pick any random string... But for email address signup, as the exact quote mentions, there is no additional context switching since you already need to confirm the email address regardless.

Re: “Invalid Username or Password”: a useless security measure (2014)

#149

Post by mrmattyboy »

est wrote: post #73

The best measure? Let any login pass, just generate a fake account if the credentials were wrong.

Hah, I did this ages ago in notebook application that I wrote for myself..

Though the amount of times I went a long time between logging in, got the wrong credentials and got scared very quickly when all of my notes had vanished :P

Re: “Invalid Username or Password”: a useless security measure (2014)

#150

Post by samwillis »

darrinmn wrote: post #80

> 99.9% of websites on the Internet will only let you create one account for each email address. So if you want to see if an email address has an account, try signing up for a new account with the same email address. This is not true if the signup flow is implemented correctly. Signing up for an account should always respond with the same message "we sent an email for you to confirm your account signup". The owner of…

The vast majority of the time the number one priority is reducing friction before a conversion. As much as a email confirmation prior to completion is more secure, the business case is far less strong.

Customers can fix their email later, they can contact customer support if they got something wrong.

Get them in the door ASAP, and either using the account, or complete an order. Don't redirect them to their email where there is a good chance they will either get distracted or the email will be delayed.

That's not to say you shouldn't also have your own measures in place to detect errors, or malicious checking if an email is associated with an account.

Post reply on HN