Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

“Invalid Username or Password”: a useless security measure (2014)

kevin.burke.dev

Post reply on HN
Print view View original

191–200 of 289 posts

Re: “Invalid Username or Password”: a useless security measure (2014)

#191

Post by toast0 »

zajio1am wrote: post #178

> 99.9% of websites on the Internet will only let you create one account for each email address. Is it common? That seems like useless and impractical limit. E.g. for e-shops, one would like to have separate accounts for personal purchases and for business/corporate purchases.

It's kind of weird when you can login to different accounts with the same username, which is typically the email address. I mean, amazon lets you do it, and I've had two accounts with the same email address and password there; but it's still pretty weird. IIRC, I had two accounts with different addresses and changed them into the same address. A lot of accounts don't let you change your email address at all, so they solve the problem that way.

Re: “Invalid Username or Password”: a useless security measure (2014)

#192

Post by Al-Khwarizmi »

Xylakant wrote: post #107
Al-Khwarizmi wrote: post #95

Earlier quoted context omitted.

In simple registrations this is fine. In multi-page registrations with long forms, it can waste the user's time by making them input all the data again when it wasn't needed, though. Except in really critical applications like payments, etc., as a user I'd rather have the convenience of being warned early about already having an account that the little extra security.

How often does it happen that you fill out a multi-page registration form just to notify you that you already have an account? I rarely bump into the issue of already having an account that I forgot. Is saving that extra amount of work in a rare case a concern in practice? Sure, it would annoy me a bit if it happened to me, but I'd be more like "man, I'm stupid" instead of "man, this site is stupid, I'll never go the…

It has happened to me sometimes with ecommerce websites that I only use once every few years.

Only a mild annoyance, but still more annoying than it would be to have someone access my account on such websites (which would be basically negligible, as I don't store payment information there, and you have to multiply it by the also negligible probability that the information leak from the login form is key in letting the bad dudes access my account).

Re: “Invalid Username or Password”: a useless security measure (2014)

#193

Post by metacritic12 »

darrinmn wrote: post #128
metacritic12 wrote: post #97

Earlier quoted context omitted.

While clever, this system has UI tradeoffs, if I need to break my signup flow in order to click on a link and return to the signup page. I believe this is also non-standard right now.

Are you saying your signup flow would automatically log the user in without confirming their email address (verify later)? I wouldn't suggest that for most websites as that would allow someone to signup with an email address they don't own. For most websites transacting with potentially sensitive information, having an email sent to confirm you own the email address should already be part of the normal flow, so I'm n…

I think the sibling post by samwillis explains my view the clearest.

Basically, the business case for breaking the signup flow to require users to check their email is low. It interrupts flow and reduces conversion rates.

The suggestion then is yes, you are allowed to use emails you don't own to sign up for an account. The reason this is allowable is that who would want to do it? The account would be broken and the real owner of that account can pop your password.

Re: “Invalid Username or Password”: a useless security measure (2014)

#194

Post by [deleted] »

darrinmn wrote: post #80

> 99.9% of websites on the Internet will only let you create one account for each email address. So if you want to see if an email address has an account, try signing up for a new account with the same email address. This is not true if the signup flow is implemented correctly. Signing up for an account should always respond with the same message "we sent an email for you to confirm your account signup". The owner of…

[deleted]

Re: “Invalid Username or Password”: a useless security measure (2014)

#195

Post by darrinmn »

emodendroket wrote: post #189
darrinmn wrote: post #148

Earlier quoted context omitted.

Yes but the exact quote is confusing as he specifically mentions email addresses (in bold text). I know the author mentions usernames elsewhere in the article and I agree with the author this isn't applicable to websites that allow username signup since anyone can pick any random string... But for email address signup, as the exact quote mentions, there is no additional context switching since you already need to con…

Often you don’t need to confirm the e-mail address to complete whatever workflow you’re doing.

Sure, companies are free to make their own choices based on their business incentives. But if you can create an account and be logged in without verifying an email address, then arguably the email address wasn't needed in the first place and you should just allow any type of username string. If the goal of your website is for email address to be the username, the you should confirm the user actually owns the email address they claim first - since anyone could lie and put a random email they don't own.

Re: “Invalid Username or Password”: a useless security measure (2014)

#196

Post by mod »

Sohcahtoa82 wrote: post #166
mod wrote: post #158

Earlier quoted context omitted.

Half the web has a CAPTCHA just to view content. Thanks, Cloudfare.

The only site that has ever asked me to solve a CAPTCHA before browsing content was pcpartpicker.com, and even that one stopped making me solve a CAPTCHA. Do you browse the web behind a VPN, Tor, or something else to hide your IP? That's been known to trigger CF's CAPTCHAs.

Yes, it's my VPN triggering it. I run my own Wireguard on a DigitalOcean box, and I'm the only user--so not exactly a lot of bad traffic coming off of my IP (may have in the past, though).

With the prevalence of Cloudfare now, it's pretty onerous to captcha every visit to a new site just because VPN. You would think Cloudfare could at least give me a "session" that persisted across the web, if they're going gatekeep the whole fucking thing.

Re: “Invalid Username or Password”: a useless security measure (2014)

#197

Post by kahrl »

tromp wrote: post #36

I'd prefer the error to be "invalid username" if the typed username is not registered, and "wrong username or password" if it is. The system only knows if the username is valid or not; it doesn't know whether it's wrong (i.e. mistyped).

I'd prefer to not create brute force vulnerability that leaks the site's list of user email addresses to an attacker.

Re: “Invalid Username or Password”: a useless security measure (2014)

#198

Post by ev1 »

KMag wrote: post #165
samwillis wrote: post #150

Earlier quoted context omitted.

The vast majority of the time the number one priority is reducing friction before a conversion. As much as a email confirmation prior to completion is more secure, the business case is far less strong. Customers can fix their email later, they can contact customer support if they got something wrong. Get them in the door ASAP, and either using the account, or complete an order. Don't redirect them to their email wher…

The lowest friction workflows make data collection/entry as lazy/delayed as possible and maximize optionality. Allow users to "save as default" as part of their normal workflows on your site, rather than demanding the information up-front at signup. The welcome/email verification email should have an expiring passwordless sign-in link (and maybe a way to set password if you decide to support passwords). If I use your…

> Side note: the McDonald's app is nice in not requiring (or apparently even allowing) passwords to log in. However, there's a problem with its state transition, where the user needs to exit from the dialog that sends the sign-in link before they go to their email and click on the sign-in link, otherwise the user gets dumped to the next step without having actually signed in.

The mcdonalds app loads several dozen data collection sdks, pihole practically had a meltdown when it launched

Re: “Invalid Username or Password”: a useless security measure (2014)

#199

Post by Sohcahtoa82 »

mod wrote: post #196
Sohcahtoa82 wrote: post #166

Earlier quoted context omitted.

The only site that has ever asked me to solve a CAPTCHA before browsing content was pcpartpicker.com, and even that one stopped making me solve a CAPTCHA. Do you browse the web behind a VPN, Tor, or something else to hide your IP? That's been known to trigger CF's CAPTCHAs.

Yes, it's my VPN triggering it. I run my own Wireguard on a DigitalOcean box, and I'm the only user--so not exactly a lot of bad traffic coming off of my IP (may have in the past, though). With the prevalence of Cloudfare now, it's pretty onerous to captcha every visit to a new site just because VPN. You would think Cloudfare could at least give me a "session" that persisted across the web, if they're going gatekeep…

> I run my own Wireguard on a DigitalOcean box, and I'm the only user

May I ask why you bother doing this? At best, unless Wireguard is also filtering your traffic, the only privacy you're getting is hiding your home IP address. Trackers will still track you by IP and build a profile based on it.

> You would think Cloudfare could at least give me a "session" that persisted across the web, if they're going gatekeep the whole fucking thing.

Yeah, that would make sense.

Re: “Invalid Username or Password”: a useless security measure (2014)

#200

Post by gauravphoenix »

MichaelCollins wrote: post #160
samwillis wrote: post #150

Earlier quoted context omitted.

The vast majority of the time the number one priority is reducing friction before a conversion. As much as a email confirmation prior to completion is more secure, the business case is far less strong. Customers can fix their email later, they can contact customer support if they got something wrong. Get them in the door ASAP, and either using the account, or complete an order. Don't redirect them to their email wher…

If reducing friction is the priority, then maybe skip email completely. Let people sign up with any username and don't require an email at all, like HN allows. Most sites that require an email don't need an email, and only ask for it so they can spam users with nonsense like product updates.

>spam users with nonsense like product updates

IMHO, not all product updates are nonsense.

Post reply on HN