“Invalid username or password” is a useless security measure • Hacker News Board

Re: “Invalid username or password” is a useless security measure

#21

Post by tracker1 » Mon, Dec 01, 2014, 7:34 PM UTC

cryptoz wrote: post #7

This doesn't address timing attacks, which are why this is done in the first place. If the code checks only for a username existing and returns the error message, this takes a measurably different amount of time compared to then also looking up if the password matches. The error shown isn't to dissuade people from using web pages to try to gain access to accounts - it's because the raw code itself doesn't know which…

I don't see how what you say is really true in a system with properly hashed/salted passwords.

    SELECT "Id", "Hash", "Salt" FROM USERS WHERE "Email" = $input

    if (results.length == 0) return -1; //No record, bad user, return early...
    if (results["Hash"] != Hash(pwd.trim(), results["Salt"]) return -2; //invalid password

Re: “Invalid username or password” is a useless security measure

#22

Post by rrrx3 » Mon, Dec 01, 2014, 7:34 PM UTC

tacostakohashi wrote: post #3

Leaving security aside, "incorrect username/password" is still the more correct and useful statement. Consider the case where you mistype your username (email). For sites like amazon, gmail, hotmail, yahoo, twitter, etc, it is entirely likely that the mistyped username is somebody else's valid username, you typed the password correctly, and "incorrect password" would hide the problem.

That statement doesn't help the user fix a problem. Either you tell the user that one of the items is incorrect - "This password does not match our records" or "This user name does not match our records". Simply stating "Incorrect username/password" isn't sufficient enough information to prevent the user from making the same error (or even a different one) again.

Here's what I tell the developers I work with: Design for the users, not for development ease. This pattern has been successfully implemented by literally hundreds (thousands? hundreds of thousands?) of websites, so there's no excuse for trying to cut a corner and try to concatenate use cases. Either the user name is right and the password is wrong, or the user name is wrong and the password doesn't matter, or both are wrong and through some miracle of absolute unicorn user error they've managed to log in to someone else's account - at which point you have a different issue altogether.

Re: “Invalid username or password” is a useless security measure

#23

Post by mbesto » Mon, Dec 01, 2014, 7:36 PM UTC

> 99.9% of websites on the Internet will only let you create one account for each email address. So if you want to see if an email address has an account, try signing up for a new account with the same email address.

That's terrible UX.

> But there's a tradeoff there between security and UX, I hear you say. I am trying to show you there is no tradeoff; you are choosing between a better user experience and a worse user experience.

I didn't reach this conclusion at all. Am I missing something?

Re: “Invalid username or password” is a useless security measure

#24

Post by thisGuysAccount » Mon, Dec 01, 2014, 7:38 PM UTC

Dylan16807 wrote: post #15

cryptoz wrote: post #7

This doesn't address timing attacks, which are why this is done in the first place. If the code checks only for a username existing and returns the error message, this takes a measurably different amount of time compared to then also looking up if the password matches. The error shown isn't to dissuade people from using web pages to try to gain access to accounts - it's because the raw code itself doesn't know which…

> This doesn't address timing attacks, which are why this is done in the first place. I don't follow. Surely the reason to hide usernames is not to prevent a timing attack that would reveal... usernames.

I might be missing what you're not following, but here's a quick explanation (and a reason why it's not a concern)

Correct username, correct password: takes 30ms to execute the code

Correct username, incorrect password: takes 15 ms to execute the code

Incorrect username: Takes 7 ms to execute the code.

You fuzz usernames, you get one that takes 15 ms, you know that's a valid username. You then start working the password.

Not necessary on most systems, because we're working at speeds that are measured in nanoseconds, and since we're using networks for many attacks, the delays are unpredictable and measured in (at least) milliseconds.

Re: “Invalid username or password” is a useless security measure

#25

Post by [deleted] » Mon, Dec 01, 2014, 7:38 PM UTC

westi wrote: post #17

cryptoz wrote: post #7

This doesn't address timing attacks, which are why this is done in the first place. If the code checks only for a username existing and returns the error message, this takes a measurably different amount of time compared to then also looking up if the password matches. The error shown isn't to dissuade people from using web pages to try to gain access to accounts - it's because the raw code itself doesn't know which…

> This doesn't address timing attacks, which are why this is done in the first place. If the code checks only for a username existing and returns the error message, this takes a measurably different amount of time compared to then also looking up if the password matches. Timing attacks are solved by how you implement the backend checking code and not how you present the result to the end user in the most user friendl…

[deleted]

Re: “Invalid username or password” is a useless security measure

#26

Post by masklinn » Mon, Dec 01, 2014, 7:38 PM UTC

darrhiggs wrote: post #18

The article misses the point that on many sites this is not a security feature, more a privacy one. I have used the 403 http status rather than 401 in the past for this exact reason. RFC 7231[0] suggests something similar "An origin server that wishes to "hide" the current existence of a forbidden target resource MAY instead respond with a status code of 404 (Not Found)." with RFC 7235[1] suggesting the use of 403. "…

As the article notes, you can trivially get around that "privacy feature" by trying to sign up with the email. If it lets you sign up there was nobody there, if it does not the email is being used by somebody else. Most sites will reject you immediately if the email is already in the system.

> RFC 7231[0] suggests something similar

Well no, RFC 7231 suggests that rather than telling an authenticated user he does not have access to a resource you can tell him the resource does not exist at all. It has nothing to do with the authentication itself, and certainly isn't suggested (let alone recommended) as a response to an invalid authentication attempt.

> valid credentials that are not adequate to gain access

How does a clear statement that the user's credentials are valid but don't give access to a resource have any relation with the rest of your comment?

Re: “Invalid username or password” is a useless security measure

#27

Post by mikeryan » Mon, Dec 01, 2014, 7:38 PM UTC

tacostakohashi wrote: post #3

Leaving security aside, "incorrect username/password" is still the more correct and useful statement. Consider the case where you mistype your username (email). For sites like amazon, gmail, hotmail, yahoo, twitter, etc, it is entirely likely that the mistyped username is somebody else's valid username, you typed the password correctly, and "incorrect password" would hide the problem.

This seems like a messaging problem?

"Password does not match our records for username/email XXX. Please check that both password and username are correct."

Responding to below This reads to me like a more verbose version of "Incorrect username or password."

Note this version is not wordsmithed and could probably be done better but the goal and inherent difference of this to the original is to let the user know that the username exists and that its the password which does not match.

Re: “Invalid username or password” is a useless security measure

#28

Post by Benferhat » Mon, Dec 01, 2014, 7:38 PM UTC

matthijs_ wrote: post #9

Excellent point. However, I think username / password will be (at least partially) replaced by this: https://passwordless.net/ - Token based authentication

If I'm not logged into a site a that I regularly use, I'm probably not logged into my email, either. In order to log into my favorite site with Passwordless, I have to log into my email as well. With my password. One login for the price of two, and I'm still using a password.

Re: “Invalid username or password” is a useless security measure

#29

Post by [deleted] » Mon, Dec 01, 2014, 7:38 PM UTC

cryptoz wrote: post #7

This doesn't address timing attacks, which are why this is done in the first place. If the code checks only for a username existing and returns the error message, this takes a measurably different amount of time compared to then also looking up if the password matches. The error shown isn't to dissuade people from using web pages to try to gain access to accounts - it's because the raw code itself doesn't know which…

[deleted]

Re: “Invalid username or password” is a useless security measure

#30

Post by tetrep » Mon, Dec 01, 2014, 7:39 PM UTC

>99.9% of websites on the Internet will only let you create one account for each email address. So if you want to see if an email address has an account, try signing up for a new account with the same email address.

While this is true, it's perfectly reasonable to require a captcha before allowing a new account to be created; greatly limiting the speed at which an attacker could enumerate emails. While it's not going to stop targeted attacks, it will mitigate mass brute forcing of weak passwords.

Regardless of the ease of username enumeration, all of the author's points about what to do are great for most sites. Rate limiting with exponential backoff and 2fa are some of the cheapest and most effective means of increasing the security of your app's authentication process.