31–40 of 76 posts
User/pass guessing by crackers can be solved with passphrases. Don't let registrants get by with a crackable password. Then remind us at the login screen that your site wants a passphrase (you can even flash me something that reminds me of the registration prompt if I forget my passphrase).
> Our old login form told users, "Your username or password is incorrect," when they may have the username right, but the password was incorrect. If you have 4 possible usernames and 4 possible passwords, you have 16 possible combinations between them—only one of which is correct. That means in this scenario, the user would have 15 chances to make an error when logging in. But when you know specifically that your use…
When you create an account and the username already exists, the website tells you that. How is this difficult for someone to do this instead of guessing the username on the login page? It's the same.
Regarding the probability of attack, people should monitor the number of different usernames attempted by a session/IP not just failed attempts against individual accounts. Otherwise it is very easy to try thousands of username combinations with a selected weak password.
As a user I strongly agree that I want to know which of my username or password is wrong. While you're at it, please remind me which characters your website allows, and how many are expected. User/pass guessing by crackers can be solved with passphrases. Don't let registrants get by with a crackable password. Then remind us at the login screen that your site wants a passphrase (you can even flash me something that re…
Very user-friendly, but not exactly secure. Each bit of information you volunteer to unauthorized user reduces the work the attacker has to do to gain access.
As for "how many expected" - limiting the password length is not exactly a good idea in any case.
This is bad advice for anyone that's not a SaaS company selling to people on non-mobile browsers, like MailChimp is. Our analytics show that many people on mobile and consumer websites do indeed want to use OAuth. (I've been meaning to do a blog post on this topic...)
From my experience with a B2C site, we see around 50% use password and 50% use social logins. The problem however is that people easily forget what they used to login with, and when they try things like a password reset, we can't really reset their passwords if they used social logins. Or they might forget whether they used google or facebook to login... So the main problem that I personally have with social logins i…
But after some further consideration, we decided that it
was a false risk, as the username reminder form already
tells you if a username exists, and is not a significant
security risk for the bajilions of sites that have them.
PS. just never let anyone from marketing, design or management discuss your security publicly without review.
With the risk of repeating myself: https://passwordless.net I think we often overdo the simple things such as authentication.
For example if I use Mailgun, a reputable service with good infrastructure and a very high rate of delivery. That still doesn't prevent random b.s. around emails not being delivered immediately due to any number of issues. If the user is left waiting for even more than a matter of seconds, they're going to give up / get annoyed.
If I can guarantee instant email delivery, essentially, I'd probably jump to this auth method.
I think the real takeaway is "Social Login Buttons Aren't Worth It _For B2B_" Very few people are going to sign up or log into a business account using a personal facebook or twitter account, and few businesses are going to have a lot of people with direct access to their facebook page and twitter feeds.
Imagine if linked in or something similarly businessish got into that space. I have a hotmail account I use for all my professional MS related needs that has become my business social sign-on account. In general, there's room for innovation here. Google really screwed the pooch when they decided Plus Circles were an internal organizational tool instead of a public facade.
Using something other that Twitter makes no sense for us.
Earlier quoted context omitted.
the reason for it is specifically addressed in the article... "But after some further consideration, we decided that it was a false risk, as the username reminder form already tells you if a username exists"
For usernames it might be true but many sites use emails instead of usernames (and rightfully so, it's already complicated for people to remember passwords without forcing them to also remember an unique username). Emails are more personal and might be easier to link back to personal information. Thus, confirming that there is an associated account with a given email is also a privacy leak, because maybe people don't…