“Invalid Username or Password”: a useless security measure (2014) • Hacker News Board

Re: “Invalid Username or Password”: a useless security measure (2014)

#171

Post by MichaelCollins » Wed, Nov 23, 2022, 5:24 PM UTC

marcosdumay wrote: post #169

MichaelCollins wrote: post #160

Earlier quoted context omitted.

If reducing friction is the priority, then maybe skip email completely. Let people sign up with any username and don't require an email at all, like HN allows. Most sites that require an email don't need an email, and only ask for it so they can spam users with nonsense like product updates.

Any site that requires a password will need an email for password resets.

If the site doesn't need email for anything besides that, then it doesn't need email for that either. Let the user set an email for account recovery if they want, but don't require it. If users who choose not to give an email forget their password, they can simply create another account.

This is the way HN works. It's the way most websites used to work, until maybe 15 years ago, give or take. Today almost all sites ask for verified email addresses, but this used to not be the case.

Besides the commercial value of having user email addresses, I think it's mostly done for the webdev's ego:

> Users need to hear about my new update! (Because if I don't spam their inbox, nobody will notice or care about the thing I just did.)

Re: “Invalid Username or Password”: a useless security measure (2014)

#172

Post by [deleted] » Wed, Nov 23, 2022, 5:24 PM UTC

darrinmn wrote: post #80

> 99.9% of websites on the Internet will only let you create one account for each email address. So if you want to see if an email address has an account, try signing up for a new account with the same email address. This is not true if the signup flow is implemented correctly. Signing up for an account should always respond with the same message "we sent an email for you to confirm your account signup". The owner of…

[deleted]

Re: “Invalid Username or Password”: a useless security measure (2014)

#173

Post by ARandumGuy » Wed, Nov 23, 2022, 5:29 PM UTC

comprev wrote: post #22

joosters wrote: post #5

But the error message can be true. If you mistype your username, you might have entered another, existing username. Just telling the user 'wrong password' will mean they are less likely to check that the username was correct. The website doesn't always know which one you got wrong, and assuming one way or the other just makes things worse.

Quoted post unavailable.

How big of an issue is it to leak this information? Disregarding the fact that many sites easily leak this info, how much security is actually gained by obfuscating what usernames are taken?

It seems to me like two factor authentication, rate limiting logins, good password rules, and properly securing passwords provide much better security then obfuscating usernames. There's always a balance between security and usability. I don't think hiding username availability provides enough security to justify the harm in the user experience.

Re: “Invalid Username or Password”: a useless security measure (2014)

#174

Post by Sohcahtoa82 » Wed, Nov 23, 2022, 5:31 PM UTC

mod wrote: post #159

t43562 wrote: post #3

Does it matter given that browsers can remember the username/password anyhow? On the other hand it's probably more important for user experience to encourage secure (long) memorable passwords rather than the fashion of impossible-to-remember short random ones. i.e I understand that something like "Iamafunnysailorwithalittlereddog" is better than "4kbjk5rv!" simply because length makes any password much harder to crac…

Length doesn't make it harder to crack, entropy does. Length is a good way to add entropy if the characters are not predictable. "Ava234ncqli3h23rn2f" is a lot stronger than "Ava234ncqli3" "DonaldTrump" is barely stronger than "Donald" Hopefully that makes sense.

> "DonaldTrump" is barely stronger than "Donald"

I mean, this is only true if you know your target is a raging Trump supporter.

Obviously, that's a very cherry-picked example, but generally, length IS entropy, even if the characters are somewhat predictable when seen by a human, as long as you have no reason to predict the password based on the things the person likes.

To give another example, "Inmyyoungerandmorevulnerableyears" is going to be an insecure password despite its length if your entire personality revolves around how much you like The Great Gatsy.

On the other hand, something based on random words like "defaultsocksillegalinstalledconnections" is going to be VERY secure, despite how readable it is, because it's still gibberish and is long.

Re: “Invalid Username or Password”: a useless security measure (2014)

#175

Post by calibas » Wed, Nov 23, 2022, 5:32 PM UTC

capableweb wrote: post #35

comprev wrote: post #22

Earlier quoted context omitted.

Quoted post unavailable.

This is mentioned in the submission. The argument is as follows: If you're vague on the login page but still do the validation on the signup page, the information leakage happens regardless, just on the signup page rather than login, as most websites only allow one account per email.

That's a good argument for not letting the signup page leak information.

Re: “Invalid Username or Password”: a useless security measure (2014)

#176

Post by Sohcahtoa82 » Wed, Nov 23, 2022, 5:33 PM UTC

sgjohnson wrote: post #13

I'd say it's wrong to assume it's even a security measure. I'm fairly sure it goes like this if (db->query("SELECT * FROM `users` WHERE `email` = 'yesthisisdog@gmail.com' AND `password` = MD5('hunter2')") { login(username); } else { error('invalid username or password'); } with nobody giving it a second thought.

Everything about that query makes me cry.

Re: “Invalid Username or Password”: a useless security measure (2014)

#177

Post by ruined » Wed, Nov 23, 2022, 5:33 PM UTC

MichaelCollins wrote: post #160

samwillis wrote: post #150

Earlier quoted context omitted.

The vast majority of the time the number one priority is reducing friction before a conversion. As much as a email confirmation prior to completion is more secure, the business case is far less strong. Customers can fix their email later, they can contact customer support if they got something wrong. Get them in the door ASAP, and either using the account, or complete an order. Don't redirect them to their email wher…

If reducing friction is the priority, then maybe skip email completely. Let people sign up with any username and don't require an email at all, like HN allows. Most sites that require an email don't need an email, and only ask for it so they can spam users with nonsense like product updates.

sending those messages is part of the same business case as reducing friction by not confirming the address :)

Re: “Invalid Username or Password”: a useless security measure (2014)

#178

Post by zajio1am » Wed, Nov 23, 2022, 5:35 PM UTC

> 99.9% of websites on the Internet will only let you create one account for each email address.

Is it common? That seems like useless and impractical limit. E.g. for e-shops, one would like to have separate accounts for personal purchases and for business/corporate purchases.

Re: “Invalid Username or Password”: a useless security measure (2014)

#179

Post by blacksmith_tb » Wed, Nov 23, 2022, 5:36 PM UTC

MichaelCollins wrote: post #160

samwillis wrote: post #150

Earlier quoted context omitted.

The vast majority of the time the number one priority is reducing friction before a conversion. As much as a email confirmation prior to completion is more secure, the business case is far less strong. Customers can fix their email later, they can contact customer support if they got something wrong. Get them in the door ASAP, and either using the account, or complete an order. Don't redirect them to their email wher…

If reducing friction is the priority, then maybe skip email completely. Let people sign up with any username and don't require an email at all, like HN allows. Most sites that require an email don't need an email, and only ask for it so they can spam users with nonsense like product updates.

I'd say that depends on what 'a conversion' is - if it's buying physical things (and getting shipping confirmations for them), an email is maybe not absolutely required, but most of your customers would probably still rather they got those?

Re: “Invalid Username or Password”: a useless security measure (2014)

#180

Post by MichaelCollins » Wed, Nov 23, 2022, 5:36 PM UTC

gohohn wrote: post #118

godshatter wrote: post #114

Earlier quoted context omitted.

Most of those are trying to track me around the net for their own purposes. I'm not volunteering any extra information for them to profile me with. No thanks.

The only extra information you would be volunteering is that you signed in to a specific website. In most cases, this is not really a big deal.

> this is not really a big deal.

If it's not a big deal, then why do they offer this service "for free"?

It's all part of their commercial panopticon. You're missing the forest for the trees.