Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

“Invalid Username or Password”: a useless security measure (2014)

kevin.burke.dev

Post reply on HN
Print view View original

261–270 of 289 posts

Re: “Invalid Username or Password”: a useless security measure (2014)

#261

Post by Thorrez »

prmph wrote: post #66
wongarsu wrote: post #32

Earlier quoted context omitted.

And those services also plug the forgotten-password information leak by just informing you "if you have an account, you got an email" instead of giving you an explicit success or error message. I guess the better point for the article would be "many websites cargo-cult the login error message without understanding why it's there and how that should impact the rest of the service"

> And those services also plug the forgotten-password information leak by just informing you "if you have an account, you got an email" instead of giving you an explicit success or error message. This might be a better approach, but one problem I see with it is: what if the email is not actually delivered because of an internal bug in the website? How would users know they didn't receive an email they were supposed t…

That same problem can happen regardless of whether the password reset flow checks for user existence before sending the email.

Re: “Invalid Username or Password”: a useless security measure (2014)

#262

Post by listenallyall »

chongli wrote: post #236
Alupis wrote: post #201

Earlier quoted context omitted.

These are not good examples of everyday websites. Southwest Airlines knows an awful lot more information about you than you provide them. They don't need your email address because they know who you are - and they make it your responsibility to monitor changes to your schedule/flight. Dominos Pizza allows you to monitor in real time the status of your delivery on their website after checkout. You can provide an email…

Dominos Pizza allows you to monitor in real time the status of your delivery on their website after checkout Dominos doesn't even verify that you own an email address when you register one. I have received Dominos delivery updates sent to my email address for pizzas delivered to a person who doesn't even live in the same country as me. These updates contained a bunch of PII information about the customer including th…

> Dominos doesn't even verify that you own an email address when you register one

Considering that Domino's doesn't verify you're actually at the physical address you're having a pizza delivered to, I doubt they are sweating an email addy

Re: “Invalid Username or Password”: a useless security measure (2014)

#263

Post by listenallyall »

quacksilver wrote: post #226
MichaelCollins wrote: post #185

Earlier quoted context omitted.

Maybe they want SMS updates to their shipping, does that mean you should ask for confirmed phone numbers on signup? Of course not. Let them enter their email or phone number for shipping updates when they're confirming their purchase. Ideally you shouldn't require users to make an account to make a purchase at all. There should be a "guest" path for purchases. Some sites still get this right. I can buy anything from…

Could part of the pattern for requiring an email address (or phone number) at time of purchase be reduced customer support costs for the vendor. With an email address the customer can reset their own password for using their account with self service features - like get a duplicate invoice or view/change/cancel a reservation or similar stuff. Without an email address / phone number / something to link a customer to t…

You're missing his point. He's saying that the whole point of having an "account" is often not actually necessary. Domino's and Southwest are much more focused on making it as easy as possible to buy a pizza or a plane ticket, without an account being mandatory.

Re: “Invalid Username or Password”: a useless security measure (2014)

#264

Post by iudqnolq »

darrinmn wrote: post #80

> 99.9% of websites on the Internet will only let you create one account for each email address. So if you want to see if an email address has an account, try signing up for a new account with the same email address. This is not true if the signup flow is implemented correctly. Signing up for an account should always respond with the same message "we sent an email for you to confirm your account signup". The owner of…

By your definition almost no popular website - including Google - implements signup flow correctly.

Re: “Invalid Username or Password”: a useless security measure (2014)

#266

Post by thepors »

scarface74 wrote: post #89
justsomehnguy wrote: post #19

> Check submitted passwords against a dictionary of common passwords (123456, monkey, etc) and ban that traffic extra hard. > Give guidance to users about creating strong passwords Yeah, if I just want to talk about a propane with some folks I would eagerly wait to be lectured about IT security, scolded at my passwords of choice, go out of my way to appease site administrator's password policy...

Or with any modern password manager - including the one built into Apple devices - you could just click on “choose strong password” and have one generated for you and stored.

I'm not sure but it's really hard to remember. Especially when you have to access a new device and you can't access the old one.

Re: “Invalid Username or Password”: a useless security measure (2014)

#267

Post by jhauris »

Alupis wrote: post #248
parminya wrote: post #230

Earlier quoted context omitted.

> Permanently losing access to an account sucks a lot. But mostly that's all. Usually it's a minor inconvenience. Occasionally it sucks a bit. Rarely it sucks a lot. Almost never is anything of value lost. It can be wholly eliminated by good data practices e.g. backups. (No one backs up their Amazon account data. It isn't designed for it. Because the "webdevs" think of the data as their boss's - squarequoting "webdev…

There are some exceptions to this. Notably, Amazon is ruthless in enforcement of their "One Person, One Account" policy (worded not so eloquently in their official terms). If you lose access to your Amazon account and open a new account, there's a non-trivial chance they shut it down without explanation. If your account ever participated in the marketplace from a seller side, then this policy is even more ruthlessly…

Is this policy for a specific kind of Amazon account? I didn't recall seeing anything in the TOS, and they appear to have first class support for people with multiple accounts.

https://www.amazon.com/gp/help/customer/display.html%3FnodeI...

Re: “Invalid Username or Password”: a useless security measure (2014)

#268

Post by physicles »

andrelaszlo wrote: post #81

I don't get it. It's fine to leak/allow user enumeration on the login page because it's leaked elsewhere anyway? That's a pretty big assumption. One way to allow users to register using their email address without leaking any information is to just say "user created, please check your inbox to confirm your email address" or something like that. If the user already exists, swap the confirmation email for a warning ema…

In a sense, yes. If you’re revealing an account’s existence on one page, your system isn’t made more secure if you hide its existence on another page. If you think it does, you’re fooling yourself. Better to use other tools (like rate limiting) to improve security.

And yes, you’re missing the second part of the article where the author mentions the registration flow you describe and then points out that it’s not a great user experience.

Re: “Invalid Username or Password”: a useless security measure (2014)

#269

Post by ranguna »

cozzyd wrote: post #223
metacritic12 wrote: post #193

Earlier quoted context omitted.

I think the sibling post by samwillis explains my view the clearest. Basically, the business case for breaking the signup flow to require users to check their email is low. It interrupts flow and reduces conversion rates. The suggestion then is yes, you are allowed to use emails you don't own to sign up for an account. The reason this is allowable is that who would want to do it? The account would be broken and the r…

well, a user might put in the wrong email by mistake...

They can just creat another account then

Re: “Invalid Username or Password”: a useless security measure (2014)

#270

Post by Komodai »

mod wrote: post #196
Sohcahtoa82 wrote: post #166

Earlier quoted context omitted.

The only site that has ever asked me to solve a CAPTCHA before browsing content was pcpartpicker.com, and even that one stopped making me solve a CAPTCHA. Do you browse the web behind a VPN, Tor, or something else to hide your IP? That's been known to trigger CF's CAPTCHAs.

Yes, it's my VPN triggering it. I run my own Wireguard on a DigitalOcean box, and I'm the only user--so not exactly a lot of bad traffic coming off of my IP (may have in the past, though). With the prevalence of Cloudfare now, it's pretty onerous to captcha every visit to a new site just because VPN. You would think Cloudfare could at least give me a "session" that persisted across the web, if they're going gatekeep…

No post body was provided.
Post reply on HN