Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

“Invalid Username or Password”: a useless security measure (2014)

kevin.burke.dev

Post reply on HN
Print view View original

181–190 of 289 posts

Re: “Invalid Username or Password”: a useless security measure (2014)

#181

Post by justsomehnguy »

scarface74 wrote: post #89
justsomehnguy wrote: post #19

> Check submitted passwords against a dictionary of common passwords (123456, monkey, etc) and ban that traffic extra hard. > Give guidance to users about creating strong passwords Yeah, if I just want to talk about a propane with some folks I would eagerly wait to be lectured about IT security, scolded at my passwords of choice, go out of my way to appease site administrator's password policy...

Or with any modern password manager - including the one built into Apple devices - you could just click on “choose strong password” and have one generated for you and stored.

That works fine till you have the access to your password manager.

If you ever find yourself without it... imagine your Apple device got broken/stolen. You would be fine wihtout an ability to talk on some forum, but what about critical banking, e-gov sites?

Re: “Invalid Username or Password”: a useless security measure (2014)

#182

Post by gohohn »

bombcar wrote: post #136
gohohn wrote: post #118

Earlier quoted context omitted.

The only extra information you would be volunteering is that you signed in to a specific website. In most cases, this is not really a big deal.

You are also trusting the Oauth provider to never login as you for their own inscrutable purposes.

That is true. But then many people put a lot of trust in the major providers in many other areas too, such as hosting their private files and email, holding card payment information, and so on.

Re: “Invalid Username or Password”: a useless security measure (2014)

#183

Post by MichaelCollins »

bombcar wrote: post #136
gohohn wrote: post #118

Earlier quoted context omitted.

The only extra information you would be volunteering is that you signed in to a specific website. In most cases, this is not really a big deal.

You are also trusting the Oauth provider to never login as you for their own inscrutable purposes.

Absolutely. In the case of Facebook, it's easy to imagine them logging into websites as you to slurp up your contact list on that site. Don't worry, you agreed to it somewhere in the thousand pages of small print!

Or as the case of twitter demonstrates, you're also trusting all future owners of the Oauth provider, whoever they may be. If an erratic billionaire with a penchant for breaking the rules whenever it suits him buys your Oauth provider, who's to say what he'll do with his new access? He could treat your accounts as his personal toys. Better hope you don't earn his personal ire when he's on another wine and ambien bender.

Re: “Invalid Username or Password”: a useless security measure (2014)

#184

Post by wccrawford »

zajio1am wrote: post #178

> 99.9% of websites on the Internet will only let you create one account for each email address. Is it common? That seems like useless and impractical limit. E.g. for e-shops, one would like to have separate accounts for personal purchases and for business/corporate purchases.

Yes, it really is like 99.9% of websites.

If you need multiple accounts, use multiple emails addresses, 1 each. You should keep your personal and corporate email separate anyhow.

Re: “Invalid Username or Password”: a useless security measure (2014)

#185

Post by MichaelCollins »

blacksmith_tb wrote: post #179
MichaelCollins wrote: post #160

Earlier quoted context omitted.

If reducing friction is the priority, then maybe skip email completely. Let people sign up with any username and don't require an email at all, like HN allows. Most sites that require an email don't need an email, and only ask for it so they can spam users with nonsense like product updates.

I'd say that depends on what 'a conversion' is - if it's buying physical things (and getting shipping confirmations for them), an email is maybe not absolutely required, but most of your customers would probably still rather they got those?

Maybe they want SMS updates to their shipping, does that mean you should ask for confirmed phone numbers on signup? Of course not. Let them enter their email or phone number for shipping updates when they're confirming their purchase.

Ideally you shouldn't require users to make an account to make a purchase at all. There should be a "guest" path for purchases. Some sites still get this right. I can buy anything from plane tickets to pizzas without having an account on the company's website. Meanwhile half the "Show HN" non-commercial toy websites I come across seem to require a confirmed email for no good reason at all (probably because the webdev is hoping his little toy website somehow becomes a real business, and then he can spam my inbox with updates about this and turn me into a paying customer.)

Off the top of my head, here are some companies that don't require me to confirm my email address when making a purchase or an account: Southwest Airlines. Dominos Pizza, Hacker News, Reddit.

If those guys don't need a confirmed email address, probably your site doesn't either.

Re: “Invalid Username or Password”: a useless security measure (2014)

#186

Post by IshKebab »

darrinmn wrote: post #80

> 99.9% of websites on the Internet will only let you create one account for each email address. So if you want to see if an email address has an account, try signing up for a new account with the same email address. This is not true if the signup flow is implemented correctly. Signing up for an account should always respond with the same message "we sent an email for you to confirm your account signup". The owner of…

I've used exactly one site ever that had this sign-up flow, and hundreds that had the stupid "invalid username or password" error.

Re: “Invalid Username or Password”: a useless security measure (2014)

#187

Post by emodendroket »

This is a bit like the “don’t write your passwords” stuff. It doesn’t matter how obvious the arguments against it are — the author of this piece is not the first to note the absurdity of this setup — it is engrained as “best practice” and you will be fighting an uphill battle as a heretic trying to do anything else. I’ve lost similar arguments for similar reasons.

Re: “Invalid Username or Password”: a useless security measure (2014)

#188

Post by scarface74 »

justsomehnguy wrote: post #181
scarface74 wrote: post #89

Earlier quoted context omitted.

Or with any modern password manager - including the one built into Apple devices - you could just click on “choose strong password” and have one generated for you and stored.

That works fine till you have the access to your password manager. If you ever find yourself without it... imagine your Apple device got broken/stolen. You would be fine wihtout an ability to talk on some forum, but what about critical banking, e-gov sites?

My passwords are synced between all of my devices - iPad, iPhone, and Mac.

Even if I lost all of my devices, I could walk into a store, buy a new device and log in and all of my passwords with be in sync.

Re: “Invalid Username or Password”: a useless security measure (2014)

#189

Post by emodendroket »

darrinmn wrote: post #148
emodendroket wrote: post #146

Earlier quoted context omitted.

That exact strategy is described in the second paragraph but the author argues (and I agree) that it is so arduous it will cause you to lose many users for questionable benefit.

Yes but the exact quote is confusing as he specifically mentions email addresses (in bold text). I know the author mentions usernames elsewhere in the article and I agree with the author this isn't applicable to websites that allow username signup since anyone can pick any random string... But for email address signup, as the exact quote mentions, there is no additional context switching since you already need to con…

Often you don’t need to confirm the e-mail address to complete whatever workflow you’re doing.
Post reply on HN