“Invalid username or password” is a useless security measure • Hacker News Board

Re: “Invalid username or password” is a useless security measure

#51

Post by andrewstuart2 » Mon, Dec 01, 2014, 7:54 PM UTC

I think the real lesson here is that if emails should remain secret you should not indicate upon signup whether or not a user exists with that email.

Always send an email.

If that user already exists, make sure the email says "We noticed you're trying to sign up again. If you didn't do this, someone else is trying to sign up for you." If that user doesn't exist, send them the typical signup message.

The author has some great security tips in the "what should I do instead" but I don't think the instead portion is accurate. Keep private information private, and make access to public information as easy as it should be.

If emails are public, shoot, use a websocket connection to style the login field in real time and show the user whether or not the email they typed is valid.

Re: “Invalid username or password” is a useless security measure

#52

Post by pornel » Mon, Dec 01, 2014, 7:54 PM UTC

tetrep wrote: post #30

>99.9% of websites on the Internet will only let you create one account for each email address. So if you want to see if an email address has an account, try signing up for a new account with the same email address. While this is true, it's perfectly reasonable to require a captcha before allowing a new account to be created; greatly limiting the speed at which an attacker could enumerate emails. While it's not going…

However most sites reveal existence of an account before requiring a captcha, and many sites can't even fix this.

e.g. Twitter can't require captcha before letting me see twitter.com/username …but they're still doing this security theater.

Re: “Invalid username or password” is a useless security measure

#53

Post by darrhiggs » Mon, Dec 01, 2014, 7:54 PM UTC

darrhiggs wrote: post #18

The article misses the point that on many sites this is not a security feature, more a privacy one. I have used the 403 http status rather than 401 in the past for this exact reason. RFC 7231[0] suggests something similar "An origin server that wishes to "hide" the current existence of a forbidden target resource MAY instead respond with a status code of 404 (Not Found)." with RFC 7235[1] suggesting the use of 403. "…

Given that I have received downvotes I'll try more concrete example. Imagine that you start dating a someone and they discover your email, maybe you email them. Now they then take that information and try and log into a site that you do not wish that others know you use, this may be a porn site, it may be a group that you associate yourself with, say even a feminist forum. Now if you respond that it's the wrong password people are able to deduce (given that there is also a wrong username error) that you are a user of that service.

Imagine you put your email on your cv and this is done to see if you a member of a democrat or republican website, and you are not offered a job based on your political views.

Imagine that you use your email to sign up for a government service and they take that email, do as described above, and use the information in the future to discredit you in some way.

Maybe I have missed the point, but I personally think that this is a also privacy issue and only looking at it from the perspective of UX may have undesired consequences for people.

Re: “Invalid username or password” is a useless security measure

#54

Post by pbreit » Mon, Dec 01, 2014, 7:55 PM UTC

tacostakohashi wrote: post #3

Leaving security aside, "incorrect username/password" is still the more correct and useful statement. Consider the case where you mistype your username (email). For sites like amazon, gmail, hotmail, yahoo, twitter, etc, it is entirely likely that the mistyped username is somebody else's valid username, you typed the password correctly, and "incorrect password" would hide the problem.

"is still the more correct and useful statement"

No, it is usually incorrect and it is much less helpful than identifying which is incorrect.

"it is entirely likely that the mistyped username is somebody else's valid username"

No, that's highly unlikely.

If the email isn't in the DB, just say so. If the password doesn't match, just say so.

Re: “Invalid username or password” is a useless security measure

#55

Post by masklinn » Mon, Dec 01, 2014, 7:55 PM UTC

andrewstuart2 wrote: post #43

baddox wrote: post #38

Earlier quoted context omitted.

You didn't really address the parent's point, which is that their misspelled username might match another real username. In this case, telling them that their password is incorrect is actively sending them down the wrong path, because they are likely to try fixing the password field rather than the username field.

Telling them "correct password, wrong email" seems like a bit of an information leak if you ask me. I think a "did you mean?" output in case of a bad password as long as there are lexically similar usernames in the database.

Ignoring the fact that doing that would be retarded, if you're following modern practices and hashing passwords with KDFs that's not really possible without killing your server.

Re: “Invalid username or password” is a useless security measure

#56

Post by nanofortnight » Mon, Dec 01, 2014, 7:55 PM UTC

tracker1 wrote: post #21

cryptoz wrote: post #7

This doesn't address timing attacks, which are why this is done in the first place. If the code checks only for a username existing and returns the error message, this takes a measurably different amount of time compared to then also looking up if the password matches. The error shown isn't to dissuade people from using web pages to try to gain access to accounts - it's because the raw code itself doesn't know which…

I don't see how what you say is really true in a system with properly hashed/salted passwords. SELECT "Id", "Hash", "Salt" FROM USERS WHERE "Email" = $input if (results.length == 0) return -1; //No record, bad user, return early... if (results["Hash"] != Hash(pwd.trim(), results["Salt"]) return -2; //invalid password

Your code has precisely the timing attack he tried to describe in it. You're returning early when a user doesn't exist.

Re: “Invalid username or password” is a useless security measure

#57

Post by SixSigma » Mon, Dec 01, 2014, 7:55 PM UTC

cryptoz wrote: post #7

This doesn't address timing attacks, which are why this is done in the first place. If the code checks only for a username existing and returns the error message, this takes a measurably different amount of time compared to then also looking up if the password matches. The error shown isn't to dissuade people from using web pages to try to gain access to accounts - it's because the raw code itself doesn't know which…

That would make it an even worse pattern, your implementation leaking into your UI.

Re: “Invalid username or password” is a useless security measure

#58

Post by csallen » Mon, Dec 01, 2014, 7:57 PM UTC

baddox wrote: post #41

tetrep wrote: post #30

>99.9% of websites on the Internet will only let you create one account for each email address. So if you want to see if an email address has an account, try signing up for a new account with the same email address. While this is true, it's perfectly reasonable to require a captcha before allowing a new account to be created; greatly limiting the speed at which an attacker could enumerate emails. While it's not going…

But requiring a captcha before validating the uniqueness of each username would be pretty annoying for large websites where many of the usernames I would choose are already taken.

Which doesn't matter, because there's no point in keeping usernames secret (and thus no point providing a captcha) unless those usernames are email addresses, in which case it's unlikely that the username you want will be taken.

Re: “Invalid username or password” is a useless security measure

#59

Post by shabble » Mon, Dec 01, 2014, 7:57 PM UTC

tracker1 wrote: post #21

cryptoz wrote: post #7

This doesn't address timing attacks, which are why this is done in the first place. If the code checks only for a username existing and returns the error message, this takes a measurably different amount of time compared to then also looking up if the password matches. The error shown isn't to dissuade people from using web pages to try to gain access to accounts - it's because the raw code itself doesn't know which…

I don't see how what you say is really true in a system with properly hashed/salted passwords. SELECT "Id", "Hash", "Salt" FROM USERS WHERE "Email" = $input if (results.length == 0) return -1; //No record, bad user, return early... if (results["Hash"] != Hash(pwd.trim(), results["Salt"]) return -2; //invalid password

If you have an index on your "Email" field in the database, there may be discernible difference between the time taken to check the index and return '0 rows', vs getting a match and actually reading the appropriate data to build the result row.

I don't know if there's a solution to that in the general scheme of things, other than making the variance of query times between no user and some user as small as possible.

Re: “Invalid username or password” is a useless security measure

#60

Post by dllthomas » Mon, Dec 01, 2014, 7:58 PM UTC

darrhiggs wrote: post #53

darrhiggs wrote: post #18

The article misses the point that on many sites this is not a security feature, more a privacy one. I have used the 403 http status rather than 401 in the past for this exact reason. RFC 7231[0] suggests something similar "An origin server that wishes to "hide" the current existence of a forbidden target resource MAY instead respond with a status code of 404 (Not Found)." with RFC 7235[1] suggesting the use of 403. "…

Given that I have received downvotes I'll try more concrete example. Imagine that you start dating a someone and they discover your email, maybe you email them. Now they then take that information and try and log into a site that you do not wish that others know you use, this may be a porn site, it may be a group that you associate yourself with, say even a feminist forum. Now if you respond that it's the wrong passw…

It is certainly the case that there is a privacy issue here. However, that doesn't substantially undermine the strongest point presented in the article - that the email is already exposed, usually by refusing to create a new account if one exists with that email and it's sometimes also reported when you ask for a password reset email.

I agree with you that the thing to do is fix those issues, though, rather than abandon it here as well.