Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

“Invalid Username or Password”: a useless security measure (2014)

kevin.burke.dev

Post reply on HN
Print view View original

241–250 of 289 posts

Re: “Invalid Username or Password”: a useless security measure (2014)

#241

Post by Terretta »

MostlyInnocent wrote: post #152

The article makes a good point, were it not for security auditors (SAs). SA: You leak information and therefore violate policy by disclosing on the login form whether an account exists or not! Me: Yeah, but figuring out if an account exists is really simple anyway: just a query to a different endpoint... SA: NEVERMIND, MY LAD: disclosing account existence upon login violates BEST PRACTICES! Me: OK, yeah, whatever, we…

Every well known credit card / credit data breach has been of a PCI-DSS compliant party.

To any SAs reading this: you're not secure because you're compliant.

Re: “Invalid Username or Password”: a useless security measure (2014)

#242

Post by EamonnMR »

MichaelCollins wrote: post #171
marcosdumay wrote: post #169

Earlier quoted context omitted.

Any site that requires a password will need an email for password resets.

If the site doesn't need email for anything besides that, then it doesn't need email for that either. Let the user set an email for account recovery if they want, but don't require it. If users who choose not to give an email forget their password, they can simply create another account. This is the way HN works. It's the way most websites used to work, until maybe 15 years ago, give or take. Today almost all sites a…

Yeah you may not realize that a significant fraction of people don't remember passwords at all and need to reset on every login. If you don't allow self serve password resets you're creating a huge customer service burden.

Re: “Invalid Username or Password”: a useless security measure (2014)

#243

Post by EamonnMR »

parminya wrote: post #230
ben0x539 wrote: post #224

Earlier quoted context omitted.

I think the webdevs are right about this one. People lose or forget passwords all the time (in general not using password managers). Permanently losing access to an account sucks a lot. Tying account ownership to email primarily with passwords being more or less an optional convenience saving you the email roundtrip seems worth it.

> Permanently losing access to an account sucks a lot. But mostly that's all. Usually it's a minor inconvenience. Occasionally it sucks a bit. Rarely it sucks a lot. Almost never is anything of value lost. It can be wholly eliminated by good data practices e.g. backups. (No one backs up their Amazon account data. It isn't designed for it. Because the "webdevs" think of the data as their boss's - squarequoting "webdev…

Most people need to back up is a receipt for their transaction, and the main method people expect for receiving it is... email.

Re: “Invalid Username or Password”: a useless security measure (2014)

#244

Post by thomastjeffery »

ad404b8a372f2b9 wrote: post #217
thomastjeffery wrote: post #213

Earlier quoted context omitted.

> it often takes 10 minutes for them to send a reset email That's the only part of your description I can see that I didn't account for. For any of this to work, the email must be sent quickly.

Yes that's a crucial part of the issue, because many websites send their emails very slowly. So the lack of email can mean both: "No account for this email" "Yes, there is an account for this email but it'll become apparent much later" And your website might send emails fast, but that won't solve the issue because as a user I don't know if your website is fast or slow, so if I'm not registered with the email I entere…

There's only one UX path that doesn't involve email, apart from just logging in, and that's when you do know the password, but don't know the email. In that case, you probably only have few enough email addresses to try that that isn't an issue.

In every other path, you will definitely be waiting (hopefully not long) for an email, so what does it matter?

Re: “Invalid Username or Password”: a useless security measure (2014)

#245

Post by akerl_ »

darrinmn wrote: post #80

> 99.9% of websites on the Internet will only let you create one account for each email address. So if you want to see if an email address has an account, try signing up for a new account with the same email address. This is not true if the signup flow is implemented correctly. Signing up for an account should always respond with the same message "we sent an email for you to confirm your account signup". The owner of…

Sure, I guess? But the overwhelming majority of sites on the internet do not do this. Primarily because their new signup flow has priorities that matter an order of magnitude higher for them than avoiding leaking whether an account already exists.

Re: “Invalid Username or Password”: a useless security measure (2014)

#246

Post by janalsncm »

Is there a use case for passwords at all? Passwords have the downsides of being guessable and hackable, as well as forgotten. I’d like to avoid the “correct horse battery staple” malarkey if possible.

In most cases, control of the account email is equivalent to control of the account because I can reset the password if I control the email. So it seems that magic links or OTPs are strictly better. Am I missing something?

Re: “Invalid Username or Password”: a useless security measure (2014)

#247

Post by ad404b8a372f2b9 »

thomastjeffery wrote: post #244
ad404b8a372f2b9 wrote: post #217

Earlier quoted context omitted.

Yes that's a crucial part of the issue, because many websites send their emails very slowly. So the lack of email can mean both: "No account for this email" "Yes, there is an account for this email but it'll become apparent much later" And your website might send emails fast, but that won't solve the issue because as a user I don't know if your website is fast or slow, so if I'm not registered with the email I entere…

There's only one UX path that doesn't involve email, apart from just logging in, and that's when you do know the password, but don't know the email. In that case, you probably only have few enough email addresses to try that that isn't an issue. In every other path, you will definitely be waiting (hopefully not long) for an email, so what does it matter?

Imagine you're an average person and you have 3 emails and 3 passwords that you typically (and repeatedly) use, in any combination. (That's pretty much every non-software person I know, and me on every site before I started using a password manager)

To login you have to try 9 combinations, but your account will be frozen after 3 wrong tries.

The log-in screen does not tell you whether you have the wrong email or the wrong password.

With the sign-up screen you can immediately know which email you used, then you only have to try the 3 passwords, and then you're in.

If you don't remember the password you can go to the forgot password screen and be confident you'll get the reset email, since you know the right address to enter.

Re: “Invalid Username or Password”: a useless security measure (2014)

#248

Post by Alupis »

parminya wrote: post #230
ben0x539 wrote: post #224

Earlier quoted context omitted.

I think the webdevs are right about this one. People lose or forget passwords all the time (in general not using password managers). Permanently losing access to an account sucks a lot. Tying account ownership to email primarily with passwords being more or less an optional convenience saving you the email roundtrip seems worth it.

> Permanently losing access to an account sucks a lot. But mostly that's all. Usually it's a minor inconvenience. Occasionally it sucks a bit. Rarely it sucks a lot. Almost never is anything of value lost. It can be wholly eliminated by good data practices e.g. backups. (No one backs up their Amazon account data. It isn't designed for it. Because the "webdevs" think of the data as their boss's - squarequoting "webdev…

There are some exceptions to this. Notably, Amazon is ruthless in enforcement of their "One Person, One Account" policy (worded not so eloquently in their official terms).

If you lose access to your Amazon account and open a new account, there's a non-trivial chance they shut it down without explanation. If your account ever participated in the marketplace from a seller side, then this policy is even more ruthlessly enforced.

Which means... email address verification is necessary for Amazon to at least guard against type-o's and other common form data-entry errors.

Re: “Invalid Username or Password”: a useless security measure (2014)

#249

Post by djaychela »

janalsncm wrote: post #246

Is there a use case for passwords at all? Passwords have the downsides of being guessable and hackable, as well as forgotten. I’d like to avoid the “correct horse battery staple” malarkey if possible. In most cases, control of the account email is equivalent to control of the account because I can reset the password if I control the email. So it seems that magic links or OTPs are strictly better. Am I missing somethi…

I think you are, yes. These situations spring to mind, all of which make email OTP a worse solution imo:

Shared account without both having access to email.

Email OTP is more time and effort than entering a password.

Email can be down.

You may not have access to email for another reason (different device, etc).

Re: “Invalid Username or Password”: a useless security measure (2014)

#250

Post by yarg »

dheera wrote: post #72
prmph wrote: post #29

Earlier quoted context omitted.

> If you mistype your username, you might have entered another, existing username. That's a good point, but there is no way the website can detect that situation, and I suspect it is much less likely than typing your correct username and the wrong password. > The website doesn't always know which one you got wrong, and assuming one way or the other just makes things worse. If the website doesn't know which one you go…

> there is no way the website can detect that situation Why? The website can salt, hash, match your password against all the hashed passwords for all the closest usernames within a certain edit distance. Not saying this is a good idea security-wise, but it's not impossible.

It's also a terrible idea from a performance standpoint.
Post reply on HN