Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

“Invalid Username or Password”: a useless security measure (2014)

kevin.burke.dev

Post reply on HN
Print view View original

151–160 of 289 posts

Re: “Invalid Username or Password”: a useless security measure (2014)

#151

Post by layer8 »

thomastjeffery wrote: post #140
layer8 wrote: post #120

Earlier quoted context omitted.

This is commonly the case for online shopping, where account creation is optional and may only occur after confirmation, but the order will be placed regardless.

But in that case, there is still an account (just without login ability), and you are probably even sending an email. So in the email you can include a link to optional account (username/password) creation. And if you aren't sending an email, then the user has clearly decided not to create an account.

The problem is if an account for that email already exists, see https://news.ycombinator.com/item?id=33720063.

Re: “Invalid Username or Password”: a useless security measure (2014)

#152

Post by MostlyInnocent »

The article makes a good point, were it not for security auditors (SAs).

SA: You leak information and therefore violate policy by disclosing on the login form whether an account exists or not!

Me: Yeah, but figuring out if an account exists is really simple anyway: just a query to a different endpoint...

SA: NEVERMIND, MY LAD: disclosing account existence upon login violates BEST PRACTICES!

Me: OK, yeah, whatever, we'll just change the error message to "something you may or not have entered may or may not be valid information, try again, or not"

SA: cool beans! WE ARE NOW INDUSTRY LEADERS

Re: “Invalid Username or Password”: a useless security measure (2014)

#153

Post by layer8 »

cryptoegorophy wrote: post #144
layer8 wrote: post #104

Earlier quoted context omitted.

This is bad in the case of online orders, where the order will usually go through anyway (vendors want to sell even when you don’t confirm your email address, and don’t care a lot about someone else getting the notification emails), because if by mistake you registered your email address as new although you already had an account with that address, the order won’t get associated with your account. Or if it does autom…

Woocommerce plug-in of Wordpress solved that issue. You can checkout as a guest with someone else’s email, you won’t see other orders from that email and if you do want to see them then you need to sign up for an account

What if it wasn’t someone else’s email, but your own with an existing account? Can you re-associate your order with the existing account?

Re: “Invalid Username or Password”: a useless security measure (2014)

#154

Post by Xylakant »

asddubs wrote: post #143
wongarsu wrote: post #32

Earlier quoted context omitted.

And those services also plug the forgotten-password information leak by just informing you "if you have an account, you got an email" instead of giving you an explicit success or error message. I guess the better point for the article would be "many websites cargo-cult the login error message without understanding why it's there and how that should impact the rest of the service"

sounds like a nightmare for someone who forgot their password and has multiple emails, and isn't sure which one is right. did i use the wrong email, did it land in the spam folder, or did my email provider just quietly delete the email (which unfortunately does happen, and not just with dodgy emails/IPs)

I have multiple emails, and this never turned out to be an issue - worst case i just try all of them.

But if you want to improve the implementation, the provide can also decide to send an email in case no account is registered with that email address - "Hey, someone tried a password reset for this email, but there's no associated account. If it was you, ..., if not, ignore this email."

Re: “Invalid Username or Password”: a useless security measure (2014)

#155

Post by KMag »

thefreeman wrote: post #123
darrinmn wrote: post #117

Earlier quoted context omitted.

What do you mean login? I'm talking about the signup flow. The signin flow would be consistent with what is discussed in the article "invalid username or pw".

What do users usually do after registering an account? They try to login with it (assuming they aren't automatically logged in after registration which is what I would generally prefer / expect as a user). You are giving the user so many chances to just say "forget this" and move on to a different website. Especially if they are on mobile, registering for services is a huge pain in the butt. My basic point is you are…

If the GP is assuming that initial password setting is done via the verification link sent in the verification email, then the workflow they're proposing won't cause the confusion you describe. In other words, the "verify my email address" link is to a form that says "Create and verify password to confirm your email address."

If you're assuming that initial password entry is done before email verification, then there's a possibility for confusion there.

Honestly, the lowest friction workflows collect information lazily. Don't require setting a password (if at all... expiring login links in emails are a nice alternative) until the email is verified. Don't require a mailing address or credit card number at all, but have a "save for later" checkbox/button as part of the checkout workflow, etc.

Re: “Invalid Username or Password”: a useless security measure (2014)

#156

Post by mrmattyboy »

I'm not sure if someone has mentioned this already, but if someone has gone down the path to allow enumeration (username check during signup, which is immediately returned ton the user), I would say this is a strong argument where you could protect yourself against enumeration more easily..

The amount of times a user will likely type their username/password incorrectly is going to be a lot higher than those who attempt to re-signup for an account. Therefore adding additional protection to the signup page (hard rate limiting, bot-protection) then aids to stop this username/email enumeration without the need to be as strict on a login page. This is also compiled with ip-based rate limiting/bot protection that can get very frustrating for users within a corporation that have single public IPs for all their users.

Re: “Invalid Username or Password”: a useless security measure (2014)

#157

Post by mod »

nerf3000 wrote: post #82
kklisura wrote: post #60

> 99.9% of websites on the Internet will only let you create one account for each email address. So if you want to see if an email address has an account, try signing up for a new account with the same email address. So why not just send an email upon signup with existing email and just show success on signup? I'm guessing email would state that you already have an account there, maybe you need to reset password and…

Or just allow multiple accounts to use the same email (with an upper limit) Already people can chuck a + in the user part and register with the same email like joe+2@gmail.com so really there's not much point trying to maintain a 1:1 user to email ratio.

That's what I've always done, with an upper limit of 1.

More seriously, this just kicks the can a little bit.

"Already people can chuck a + in the user part...so really there's not much point trying to maintain a 25:1 user to email ratio"

Re: “Invalid Username or Password”: a useless security measure (2014)

#158

Post by mod »

bluenotebo0k wrote: post #31

"99.9% of websites on the Internet will only let you create one account for each email address. So if you want to see if an email address has an account, try signing up for a new account with the same email address." Yes, but signing up is a more cumbersome process and usually has a CAPTCHA attached to it, unlike logging in.

Half the web has a CAPTCHA just to view content. Thanks, Cloudfare.

Re: “Invalid Username or Password”: a useless security measure (2014)

#159

Post by mod »

t43562 wrote: post #3

Does it matter given that browsers can remember the username/password anyhow? On the other hand it's probably more important for user experience to encourage secure (long) memorable passwords rather than the fashion of impossible-to-remember short random ones. i.e I understand that something like "Iamafunnysailorwithalittlereddog" is better than "4kbjk5rv!" simply because length makes any password much harder to crac…

Length doesn't make it harder to crack, entropy does.

Length is a good way to add entropy if the characters are not predictable.

"Ava234ncqli3h23rn2f" is a lot stronger than "Ava234ncqli3"

"DonaldTrump" is barely stronger than "Donald"

Hopefully that makes sense.

Re: “Invalid Username or Password”: a useless security measure (2014)

#160

Post by MichaelCollins »

samwillis wrote: post #150
darrinmn wrote: post #80

> 99.9% of websites on the Internet will only let you create one account for each email address. So if you want to see if an email address has an account, try signing up for a new account with the same email address. This is not true if the signup flow is implemented correctly. Signing up for an account should always respond with the same message "we sent an email for you to confirm your account signup". The owner of…

The vast majority of the time the number one priority is reducing friction before a conversion. As much as a email confirmation prior to completion is more secure, the business case is far less strong. Customers can fix their email later, they can contact customer support if they got something wrong. Get them in the door ASAP, and either using the account, or complete an order. Don't redirect them to their email wher…

If reducing friction is the priority, then maybe skip email completely. Let people sign up with any username and don't require an email at all, like HN allows. Most sites that require an email don't need an email, and only ask for it so they can spam users with nonsense like product updates.
Post reply on HN